(a)(1)-(3) ''(a) RULEMAKING.— ''(1) IN GENERAL.—Except as provided in paragraph (3), not later than 90 days after the date of the enactment of this section and annually thereafter, the Secretary, acting through the Director, shall update by rule the definitions for the terms 'covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4)' and 'covered technologyCovered technologyExcept as otherwise provided in this section, the term 'covered technology' means an artificial intelligence system developed utilizing a quantity of computing power the cost of which would exceed $100,000,000 at the prevailing market price of cloud computing in the United States, as determined by the Secretary.Homeland Security Act § 2220F(g)(6)' in this section. ''(2) FACTORS.—In making a determination under paragraph (1), the Secretary shall consider the following factors: ''(A) The extent to which the costs to comply with this section might unduly burden a small business concernSmall business concernThe term 'small business concern' has the meaning given such term in section 3 of the Small Business Act (15 U.S.C. 632).Homeland Security Act § 2220F(g)(9). ''(B) The need to cover entities the activities of which have the potential to advance artificial intelligenceArtificial intelligenceThe term 'artificial intelligence' has the meaning given such term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Homeland Security Act § 2220F(g)(2) capabilities in national security, including with respect to cybersecurity and chemical, biological, radiological, or nuclear capabilities. ''(C) The capabilities of covered technologyCovered technologyExcept as otherwise provided in this section, the term 'covered technology' means an artificial intelligence system developed utilizing a quantity of computing power the cost of which would exceed $100,000,000 at the prevailing market price of cloud computing in the United States, as determined by the Secretary.Homeland Security Act § 2220F(g)(6), the deployment of such technology, and the manner in which the model weights of such technology are made available. ''(D) Such other factors as the Secretary determines relevant. ''(3) EXEMPTION.—An entity is not a covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) if such entity operates or makes available to a third party a covered technologyCovered technologyExcept as otherwise provided in this section, the term 'covered technology' means an artificial intelligence system developed utilizing a quantity of computing power the cost of which would exceed $100,000,000 at the prevailing market price of cloud computing in the United States, as determined by the Secretary.Homeland Security Act § 2220F(g)(6) for personal, academic, or non-commercial utilization only.

(b)(1)(A) 1 ''(b) SHUTDOWN CAPABILITY.— ''(1) IN GENERAL.—Not later than 90 days after the date of the enactment of this section and annually thereafter, the Secretary, acting through the Director, shall by rule require a covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) to carry out the following: ''(A) Maintain a technical capability to carry out the following actions: ''(i) Stop inference of a covered technology of such covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4). ''(ii) Terminate user access to such technology. ''(iii) Suspend access to such technology with respect to an account, user, or use pattern identified by such covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) or the Secretary as posing a risk of any of the following: ''(I) A covered incidentCovered incidentThe term 'covered incident' means an occurrence of any of the following outside of red-teaming or other structured testing: (A) Sabotage of, or interference with, a lawful instruction to shut down a covered technology. (B) Conduct of such technology that is unintended by a developer or operator of such technology and causes the death of not fewer than 10 individuals or economic damages of not less than $100,000,000. (C) Concealment of a capability, intention, or action of such technology, by such technology, from a monitoring or shutdown mechanism. (D) A loss-of-control scenario.Homeland Security Act § 2220F(g)(5). ''(II) A violation of law or the terms of service of such technology. ''(iv) Shut down such technology.

(b)(1)(B) 2 ''(B) Not later than 15 days after such covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) becomes aware of a covered incidentCovered incidentThe term 'covered incident' means an occurrence of any of the following outside of red-teaming or other structured testing: (A) Sabotage of, or interference with, a lawful instruction to shut down a covered technology. (B) Conduct of such technology that is unintended by a developer or operator of such technology and causes the death of not fewer than 10 individuals or economic damages of not less than $100,000,000. (C) Concealment of a capability, intention, or action of such technology, by such technology, from a monitoring or shutdown mechanism. (D) A loss-of-control scenario.Homeland Security Act § 2220F(g)(5) relating to such technology, submit to the Secretary a report regarding such incident.

(b)(2)-(3) ''(2) CONSIDERATION.—In carrying out paragraph (1), the Secretary shall consider the following: ''(A) Requiring a technical capability based on a graduated deployment-corrections framework that applies when there is evidence of a credible risk of a covered incidentCovered incidentThe term 'covered incident' means an occurrence of any of the following outside of red-teaming or other structured testing: (A) Sabotage of, or interference with, a lawful instruction to shut down a covered technology. (B) Conduct of such technology that is unintended by a developer or operator of such technology and causes the death of not fewer than 10 individuals or economic damages of not less than $100,000,000. (C) Concealment of a capability, intention, or action of such technology, by such technology, from a monitoring or shutdown mechanism. (D) A loss-of-control scenario.Homeland Security Act § 2220F(g)(5) and includes measures that are calibrated to the severity and immediacy of such risk, including the following measures: ''(i) Throttling or otherwise altering any of the following: ''(I) The inference rate of a covered technologyCovered technologyExcept as otherwise provided in this section, the term 'covered technology' means an artificial intelligence system developed utilizing a quantity of computing power the cost of which would exceed $100,000,000 at the prevailing market price of cloud computing in the United States, as determined by the Secretary.Homeland Security Act § 2220F(g)(6). ''(II) User access to such technology. ''(III) Compute allocation with respect to such technology. ''(ii) Disabling or restricting a capability of such technology. ''(iii) Suspending such technology. ''(iv) Shutting down such technology. ''(v) Transitioning an operation dependent on such technology to a backup system or an earlier version of such technology. ''(B) The risk that such a measure could disrupt critical infrastructure. ''(3) VOLUNTARY STANDARDS.—Not later than 180 days after the date of the enactment of this section, the Secretary, acting through the Director, shall publish on a publicly available website of the Agency voluntary standards for shutting down a covered technologyCovered technologyExcept as otherwise provided in this section, the term 'covered technology' means an artificial intelligence system developed utilizing a quantity of computing power the cost of which would exceed $100,000,000 at the prevailing market price of cloud computing in the United States, as determined by the Secretary.Homeland Security Act § 2220F(g)(6).

(c)(1)-(2) 3 ''(c) EMERGENCY AUTHORITY.— ''(1) ORDER.—If the Secretary, acting through the Director and in consultation with the Secretary of Commerce and the Director of National Intelligence, determines that a covered incidentCovered incidentThe term 'covered incident' means an occurrence of any of the following outside of red-teaming or other structured testing: (A) Sabotage of, or interference with, a lawful instruction to shut down a covered technology. (B) Conduct of such technology that is unintended by a developer or operator of such technology and causes the death of not fewer than 10 individuals or economic damages of not less than $100,000,000. (C) Concealment of a capability, intention, or action of such technology, by such technology, from a monitoring or shutdown mechanism. (D) A loss-of-control scenario.Homeland Security Act § 2220F(g)(5) has occurred, the Secretary may order the covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) at issue to take action proportionate to the nature and immediacy of such incident, which may include any of the actions described in subsection (b)(1)(A). ''(2) COVERED ENTITYCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4).—Upon an order under paragraph (1), the covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) subject to such order shall as soon as practicable carry out the following: ''(A) Preserve the model weights and telemetry of such technology. ''(B) Notify to the extent practicable each operator or user of such technology, of the following: ''(i) Such order. ''(ii) The extent to which such operator or user, as the case may be, might be affected by such order. ''(C) Confirm to the Secretary that such order has been carried out.

(c)(3)-(5) ''(3) AUDIT.—Upon a confirmation under paragraph (2)(C), the Secretary, acting through the Director, shall through audit, telemetry, on-site inspection, or other forensic review verify compliance with the order that prompted such confirmation. ''(4) CONGRESSIONAL REPORT.—Upon an order under paragraph (1), the Secretary shall submit to Congress a report regarding the covered incidentCovered incidentThe term 'covered incident' means an occurrence of any of the following outside of red-teaming or other structured testing: (A) Sabotage of, or interference with, a lawful instruction to shut down a covered technology. (B) Conduct of such technology that is unintended by a developer or operator of such technology and causes the death of not fewer than 10 individuals or economic damages of not less than $100,000,000. (C) Concealment of a capability, intention, or action of such technology, by such technology, from a monitoring or shutdown mechanism. (D) A loss-of-control scenario.Homeland Security Act § 2220F(g)(5) at issue that includes information relating to the following: ''(A) The determination under such paragraph that prompted such order. ''(B) Each action so ordered. ''(C) The covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) subject to such order. ''(5) APPEAL.— ''(A) IN GENERAL.—Not later than 48 hours after an order under paragraph (1), the covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) subject to such order may petition the Secretary for reconsideration of such order, but such petition does not stay such order. ''(B) DETERMINATION.—Not later than five days after a covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) petitions pursuant to subparagraph (A), the Secretary, acting through the Director, shall make a determination with respect to such petition, but if the Secretary fails to so make such determination, such failure is deemed to be a determination in the negative. ''(C) JUDICIAL REVIEW.—A covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) for which there is an order under paragraph (1) may request review of such order in the United States Court of Appeals for the District of Columbia Circuit on petition filed not later than 60 days after such order.

(d) ''(d) AUTHORITY.— ''(1) IN GENERAL.—With respect to this section, the Secretary, acting through the Director, may carry out any of the following: ''(A) Administer oaths and, by subpoena, require testimony and the production of documents. ''(B) Conduct an investigation within the United States and, consistent with applicable law, outside the United States. ''(2) CIVIL PENALTIES.— ''(A) IN GENERAL.—Except as provided in subparagraph (B), if the Secretary, acting through the Director, determines after reasonable notice and opportunity for a hearing that a covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) has violated this section, the Secretary may assess on such covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) a civil penalty of not more than $2,000,000 for each day on which such violation occurs. ''(B) ORDER.—If the Secretary, acting through the Director, determines after reasonable notice and opportunity for a hearing that a covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) has violated subsection (c), the Secretary may assess on such covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) a civil penalty of not more than $20,000,000 for each day on which such violation occurs. ''(C) FACTORS.—In determining the amount of a civil penalty to be assessed under subparagraph (A) or (B), the Secretary shall consider the following factors: ''(i) The nature, circumstances, extent, gravity, and duration of the violation at issue. ''(ii) The degree of culpability of the covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) at issue. ''(iii) Previous violations, if any, of this section by such covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4). ''(iv) Good-faith efforts, if any, by such covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) to comply with this section. ''(v) Whether such covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) voluntarily disclosed to the Secretary such violation. ''(vi) Any other factor that justice may require. ''(3) CIVIL ACTION.—If the Secretary, acting through the Director, believes that a violation of this section has occurred, is occurring, or is about to occur, the Secretary may refer the matter to the Attorney General to bring in an appropriate district court of the United States a civil action for appropriate relief.

(e) ''(e) COMPLIANCE.—A de minimis violation of this section, or a technical defect that results in a violation of this section, that is corrected not later than 30 days after discovery of such violation or defect, as the case may be, is not considered a violation of this section.

(f) ''(f) NON-DISCLOSURE.—Nonpublic information submitted under this section to the Secretary by a covered entityCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4) is exempt from disclosure under section 552(b)(3) of title 5, United States Code, and from any provision of State, local, or Tribal freedom of information law, open government law, open records law, or similar law relating to the disclosure of information or records.

(g) ''(g) DEFINITIONS.—In this section: ''(1) AFFILIATEAffiliateThe term 'affiliate' means an entity that controls, is controlled by, or is under common control with, another entity.6 U.S.C. § 651 (Homeland Security Act § 2220F(g)(1)).—The term 'affiliateAffiliateThe term 'affiliate' means an entity that controls, is controlled by, or is under common control with, another entity.6 U.S.C. § 651 (Homeland Security Act § 2220F(g)(1))' means an entity that controls, is controlled by, or is under common control with, another entity. ''(2) ARTIFICIAL INTELLIGENCEArtificial intelligenceThe term 'artificial intelligence' has the meaning given such term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Homeland Security Act § 2220F(g)(2).—The term 'artificial intelligenceArtificial intelligenceThe term 'artificial intelligence' has the meaning given such term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Homeland Security Act § 2220F(g)(2)' has the meaning given such term in section 5002 of the National Artificial IntelligenceArtificial intelligenceThe term 'artificial intelligence' has the meaning given such term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Homeland Security Act § 2220F(g)(2) Initiative Act of 2020 (15 U.S.C. 9401). ''(3) ARTIFICIAL INTELLIGENCE SYSTEMArtificial intelligence systemThe term 'artificial intelligence system' means any of the following: (A) Artificial intelligence. (B) A system, software, hardware, tool, or other utility that operates autonomously through the utilization of such artificial intelligence.Homeland Security Act § 2220F(g)(3).—The term 'artificial intelligence systemArtificial intelligence systemThe term 'artificial intelligence system' means any of the following: (A) Artificial intelligence. (B) A system, software, hardware, tool, or other utility that operates autonomously through the utilization of such artificial intelligence.Homeland Security Act § 2220F(g)(3)' means any of the following: ''(A) Artificial intelligenceArtificial intelligenceThe term 'artificial intelligence' has the meaning given such term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Homeland Security Act § 2220F(g)(2). ''(B) A system, software, hardware, tool, or other utility that operates autonomously through the utilization of such artificial intelligenceArtificial intelligenceThe term 'artificial intelligence' has the meaning given such term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Homeland Security Act § 2220F(g)(2). ''(4) COVERED ENTITYCovered entityExcept as otherwise provided in this section, the term 'covered entity' means an entity that satisfies the following requirements: (A) Operates a covered technology or operates a system that incorporates such technology. (B) Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. (C) Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue.Homeland Security Act § 2220F(g)(4).— ...