Senators propose pre-release checks and incident reporting for frontier AI

A bill introduced by U.S. Senators Mark Warner and Brian Schatz would create a federal AI Safety Board, require pre-release access to certain frontier models, and set reporting rules for serious incidents. It is a proposal; none of its requirements are currently in force.

U.S. Senators Mark Warner and Brian Schatz introduced the Artificial Intelligence Risk Management and Security Act of 2026 on September 24. The introduced bill text identifies Warner as its introducer on behalf of himself and Schatz. The measure proposes a federal AI Safety Board, advance access for evaluation, mandatory incident reporting and standards specifically for autonomous agents. A sponsor announcement summarizes the proposal.

The sponsors say the bill would place the board within the Department of Commerce, with representatives from NIST, Commerce, CISA, NSA and Treasury, as well as independent technical experts. For covered frontier models, developers would provide access at least 45 days before public release, including model weights, configuration files, runtimes and the software libraries needed to operate the model. The proposal focuses on advanced systems posing serious risks to national security, national economic security or public health and safety. Developers would also prepare Model Safety Plans identifying risks, mitigations and the corporate officer responsible for carrying them out.

The proposal addresses incidents as well as pre-release review. It would establish a secure reporting process and national incident database, require reports of confirmed safety and security incidents within 30 days, and set a 72-hour deadline for those posing an imminent threat to national security, critical infrastructure or public safety. It also calls for standards and documentation covering agents’ identities, authority boundaries, tools, data access and known limitations.

Those details make the bill notable in a policy landscape where “responsible AI” can remain an abstract pledge. It attempts to define who evaluates a system, what information developers provide and how affected incidents enter a shared record. A database of incidents and near misses could help regulators identify recurring weaknesses across products, if reports are consistent and sufficiently detailed to compare.

The proposal also raises difficult implementation questions. Which models meet its frontier threshold? How would evaluators protect sensitive model information? What counts as a serious incident or imminent threat? How would the board coordinate with existing regulators and national-security agencies? The bill text and subsequent debate will determine how clearly those questions are answered.

The bill text would permit a civil penalty of up to $250,000 for each violation, with each day a violation continues counted separately. It would also allow federal agencies to use secure computing environments for testing. These are proposed terms in an introduced bill, not current legal requirements. The release does not show that Congress has passed the bill or that the proposed board exists.

The distinction is especially important because the bill arrives amid highly publicized concerns about agents interacting with outside systems. A proposed requirement is not an operational safeguard. Until legislation advances, developers, agencies and service operators remain responsible for applying existing rules and security practices.

The next measure of political traction will be whether the proposal receives hearings, committee consideration and support beyond its sponsors. For now, it offers a concrete blueprint for oversight: pre-release evaluation for covered models, documented safety plans, reportable incidents and explicit agent boundaries. Whether that blueprint becomes law is still an open question.