Frontier Risk Oversight, National Transparency, Independent Evaluation, and Reporting Act (FRONTIER Act; H.R. 9925)

Tiered and cumulative obligations

The compute threshold first determines whether a developer is in the regime; conjunctive revenue and AI-expenditure thresholds then determine whether the framework-and-audit and IVO layers attach, while §6 prevents a higher tier from displacing lower-tier duties.

Benefit-risk standard

“Acceptable levels of catastrophic risk mitigation” means anticipated benefits outweigh catastrophic risk after considering probability and magnitude. It is a balancing test, not an absolute probability ceiling or a promise of zero catastrophic risk.

Incident and harm cliffs

The catastrophic-risk definition requires one incident involving specified model conduct and more than 50 deaths or serious injuries, or more than $1 billion in property loss. Repeated subthreshold harms, equity-value loss, substantially similar publicly accessible information, and lawful Federal activity fall outside that definition.

Adversarial mechanism — threshold accounting

Hard compute, affiliate, revenue, and AI-expenditure tests create incentives to characterize fine-tuning, corporate control, mixed-purpose spending, and the timing of a 36-month measurement window strategically.

Adversarial mechanism — one-way threshold ratchet

Commerce may increase coverage thresholds but has no express authority to lower them. If algorithmic efficiency permits catastrophic capability below the original compute threshold, the statutory adjustment tool cannot expand coverage downward.

Prospective stability

A threshold increase takes effect no earlier than 180 days after final publication and governs only later-arising obligations, reducing retroactive disruption while delaying any recalibration.

Commerce and developers must reconstruct nonstandard inputs

AI-related development expenditures are broader than a single tax or financial-reporting line, and aggregate training compute must include later fine-tuning, reinforcement learning, and substantial modifications.

Congress must repair facially mismatched cross-references

The supplied §2 text numbers definitions as paragraphs (1) through (22), but §3(d) cites §2 “subsection (t)” and “subsection (p),” while §3(f) cites “subsection (l),” “subsections (o) and (v),” and “subsections (k), (l), (o), and (v).” The intended ordinal mapping is inferable, but the literal references do not exist in the supplied text.

Commerce, IVOs, and courts must apply judgment-heavy terms

“Materially contribute,” “significant change,” anticipated benefit, risk probability, and acceptable mitigation lack numeric decision rules, so similar facts can produce different coverage or adequacy judgments.

The new Under Secretary must stand up a broad program

The bill assigns threshold review, rulemaking, licensing, secure reporting, enforcement support, and emergency analysis to a newly appointed office without an express general appropriation in the supplied text.

Fast APA rulemaking

The 180-day deadline accelerates a large set of Administrative Procedure Act rules, but notice, comment, technical consultation, and reasoned responses still determine whether the resulting rules are durable.

Ex ante assessor screening

IVO applicants must disclose proposed benchmarks, methods, corrective-action procedures, update methods, subcontractors, and personnel qualifications before Commerce licenses them.

Independence discipline

Funding-source disclosures, self-audits, industry-independence findings, and revocation grounds can constrain capture, but the later regime still has regulated developers retain and pay IVOs.

Attribution in license revocation

A model failure need not cost an IVO its license if the IVO identified the weakness, recommended adequate action, and the failure resulted from the developer’s failure to implement that action rather than from assessment weakness.

Method obsolescence

Commerce can revoke a license when technological evolution makes an IVO’s methods obsolete, protecting quality while potentially removing scarce assessment capacity abruptly.

Secure regulatory channel

Rules must provide secure submission and processing of assessment reports and sensitive information, making information security a condition of the oversight system itself.

The Under Secretary faces simultaneous deadlines

Framework minima, IVO licensing, modification criteria, report handling, redaction standards, and State opt-in procedures must be designed while the new office recruits technical, legal, and security staff.

The IVO labor pool is structurally conflicted

People qualified to evaluate frontier systems are likely to have current or former industry employment, funding, clients, or research ties, so independence cannot be inferred from formal ownership alone.

Section 5 activation depends on licensed capacity

The assessment clock starts only after Commerce first licenses an IVO with capacity to accept an engagement, allowing a slow licensing or capacity buildout to postpone the central very-large-developer duty.

Commerce must separate assessor failure from client failure

After a bad outcome, license review requires evidence about whether the IVO’s methods were inadequate or the developer declined an adequate recommendation, often using the same sensitive record under dispute.

Public risk governance

Framework publication exposes a developer’s risk thresholds, assessment process, release and internal-use decision process, cybersecurity, incident response, and governance commitments to external scrutiny.

Self-authored compliance baseline

The §4(c) auditor determines whether the developer substantially complied with its own published framework. That is narrower than §5’s independent assessment of whether a very large developer’s framework and mitigation are adequate.

Auditor access and incentives

The auditor receives broad access to records, systems, personnel, and unredacted materials. Reciprocal financial interests and result-contingent compensation are barred, but the developer still selects and pays the auditor.

Model-level release disclosure

Every frontier developer, not only a large one, must report release date, supported languages and modalities, intended uses, restrictions, substantial modifications, catastrophic-risk assessments and results, third-party involvement, and other framework steps.

Adversarial mechanism — confidential-deployment deferral

A deployment subject to security or national-security confidentiality obligations can remain undisclosed publicly until the model is first deployed outside those obligations, although Commerce must receive the report at deployment.

Machine-readable ambiguity

The machine-readable clause refers to “summaries described in this subsection,” while subsection (d) otherwise commands a report. The bill does not define the machine-readable schema or clearly identify which report elements must be encoded.

Accuracy and redaction limits

The special false-statement rule reaches knowing inaccuracies or false impressions in §4(d) reports, with a reasonable good-faith exception. Developers can redact for broad protected interests if they describe and justify the redaction, retain the material, and transmit an unredacted copy to Commerce.

Developers must classify moving model boundaries

A developer initially decides whether a framework change is material and whether a model change is substantial, even though those classifications trigger justification or a new report.

The audit market must supply technical competence and independence

Section 4 auditors need frontier-safety expertise but are not required to hold an IVO license, and repeat-client dependence is not eliminated by the ownership and contingent-fee bans.

Public evaluators lack a central archive and denominator

Frameworks, audit reports, and model reports remain distributed across developer websites, while confidential deployments can be absent from the public universe entirely.

Commerce must govern broad redaction discretion

Unlike §5’s express official redaction-dispute process, §4 relies on rulemaking standards and unredacted transmittal without giving the public a specific mechanism to trigger review.

Enforcers face a knowledge standard

A factual error alone does not establish the special §4(d) violation; the government must address knowledge, false impression, good faith, and reasonableness.

Reasonable-belief reporting clock

For incidents outside the imminent-injury exception, the 72-hour Commerce clock begins when a developer learns facts sufficient for a reasonable belief, not when the incident occurs. Internal investigation and escalation practices therefore affect the legally recorded delay.

Narrower urgent law-enforcement trigger

The separate 24-hour law-enforcement route covers imminent death or serious physical injury, but it does not expressly cover an imminent property-only or cyber loss. Because paragraph (1) is “except as provided in paragraph (2),” the text does not expressly require the imminent-injury incident to receive an additional 72-hour Commerce filing.

Recurring internal-use signal

Large developers must summarize internal-use catastrophic-risk assessments quarterly unless Commerce accepts another reasonable written schedule, for which the bill states no maximum interval.

Asymmetric review

Commerce must review each developer report but only may review a report submitted by a member of the public, concentrating mandatory attention on regulated entities’ submissions.

Registration gate

After the activation date, a large developer cannot develop, deploy, or operate a frontier model without a current filing and fee; renewals are annual or triggered earlier by ownership or material-information changes.

Enforcement

Section 4 violations can carry up to $1 million per violation for every continuing day, while registration-specific noncompliance carries $10,000 per day. DOJ and opted-in State Attorneys General can seek penalties and injunctions subject to Federal intervention and stay rules.

Treatment-created transparency

The public registered-developer list and annual aggregate incident report exist because of enactment. Their non-enactment values are missing, not zero, and the annual report is not expressly required to be public, numerical, machine-readable, or stable in category definitions.

Developers and enforcers must reconstruct knowledge timing

Auditing the ordinary 72-hour route requires evidence of when facts crossed a reasonable-belief threshold inside an organization, while the imminent-injury route instead turns on discovery and a 24-hour clock.

Commerce must secure highly sensitive reports

The reporting system must protect model weights, vulnerabilities, investigative leads, and national-security information while supporting review and authorized State transmission.

Federal and State enforcers must coordinate cases

State opt-in, advance notice, Federal intervention, bars on duplicative State suits, and stays after a later Federal action create a case-sequencing burden.

The ownership disclosure rule leaves a public-company gap

Private or closely held developers disclose five-percent owners, but publicly traded developers disclose only owners at or above 50 percent, omitting most substantial noncontrolling holders.

Public evaluators cannot observe complete incident incidence

Confidential submissions, anonymization, sensitive-information exclusions, and possible underreporting make reviewed-report counts an ambiguous combination of underlying safety, detection, coverage, and compliance.

Delayed coverage gate

Only a developer above the very-large financial thresholds is covered, and the mandate does not activate until Commerce licenses a capable IVO, so a thin assessor market can delay the duty.

Adequacy review

Unlike the §4 compliance audit, the IVO assesses whether the framework, governance, monitoring, and mitigation are adequate to achieve the statutory benefit-risk standard.

Internal-use coverage

Assessment, monitoring, reporting, and corrective-action duties expressly cover risks from internal model use as well as models released to third parties.

Deep but controlled access

The IVO can request unredacted records, personnel, systems, and other reasonably necessary information. Developer security protocols must be reasonable and narrowly tailored, and material limitations must appear in the report.

Recurring and event-driven review

Six months is the maximum ordinary interval, Commerce can demand ad hoc review, and the IVO has seven days to supplement a report when a prior finding, recommendation, or developer representation becomes invalid.

Adversarial mechanism — response is not guaranteed remediation

The developer must describe actions it “has taken or intends to take,” and the IVO then opines on adequacy. Section 5 does not itself impose a categorical completion deadline for every non-imminent recommendation, although rules may mandate corrective action in specified circumstances and imminent risks escalate to §8.

Assessor-client dependence

The regulated developer retains the verifier. Licensing and funding-transparency rules mitigate formal conflicts, but recurring dependence on a small set of large clients can still shape access, scope, and commercial incentives.

Commerce must create actual IVO capacity

Licensing alone is insufficient; the statutory clock depends on at least one IVO having capacity to accept an engagement, and concentrated capacity can create queues or client-allocation disputes.

IVOs need scarce and current technical expertise

Assessors must evaluate changing model capabilities, benchmarks, cybersecurity, governance, and mitigation while maintaining secure infrastructure and independence from the firms most able to supply that talent.

Developers and IVOs may contest access boundaries

“Reasonably necessary” access and “narrowly tailored” security protocols invite disputes over model weights, incident records, internal systems, copying, retention, and on-premises review.

IVO judgments are difficult to compare

The adequacy standard balances benefits and risk rather than applying a common numeric ceiling, and the bill does not require a machine-readable schema for findings, limitations, recommendations, or completion status.

Commerce must monitor promises after the report cycle

A developer can state an intention to act within the statutory response period, but the text does not create a standardized public table showing whether, when, or how completely each promised action was implemented.

Layered public and regulator disclosure

The public receives a developer-hosted summary and redacted ordinary assessment report, while Commerce and DOJ can request unredacted reports and supporting materials.

Supplemental-report transparency gap

The publication command expressly covers ordinary §5(f) assessment reports, not the §5(i) supplemental reports triggered when a prior safety finding, recommendation, or developer representation becomes invalid.

Redaction review

Federal or opted-in State officials can ask Commerce to review an overbroad redaction, but the public has no express right to trigger the same process.

Enforcement and escalation

IVOs may refer violations to Federal and opted-in State authorities and must escalate an imminent catastrophic risk within 72 hours. Developer violations can draw up to $1 million per violation for every continuing day plus an injunction.

Adversarial mechanism — broad IVO immunity

An IVO licensed when it performed the assessment is insulated from Federal and State claims for loss from materialized catastrophic risk of the frontier model it assessed, unless death or serious physical injury was proximately caused by willful misconduct. Within that assessed-model scope, property-only loss, economic loss, non-serious injury, negligence, and recklessness outside willful misconduct fall outside the sole exception.

Elevated private-action burden

A qualifying plaintiff must prove willful misconduct and causation by clear and convincing evidence, conduct consistent with IVO obligations is not willful as a matter of law, and discovery waits until the IVO has had a reasonable opportunity to seek dismissal.

FOIA boundary

Assessment reports, summaries, and support given to Commerce are exempt from FOIA, increasing the importance of the developer-hosted redacted version and limiting independent reconstruction from government files.

Congressional market monitor

GAO’s annual report creates an official recurring view of IVO count, capacity, entry barriers, and threats to industry independence, but the text does not require machine-readable tables.

Commerce and Attorneys General must audit redactions securely

Detecting overbreadth requires comparison with highly sensitive unredacted material, documented decisions, and secure sharing among opted-in jurisdictions.

Public users lack a mandated central archive

Assessment reports are distributed across developer websites, supplemental reports need not be published, and FOIA cannot supply the government-held versions.

State enforcement depends on opt-in and Federal sequencing

Federal intervention and later Federal actions can bar or stay overlapping State cases, requiring coordination before evidence or remedies become public.

Injured parties face a narrow cause and proof barrier

The immunity rule excludes many types and theories of loss, demands clear and convincing proof of willful misconduct, and delays discovery until after a dismissal motion can be heard.

IVO accountability leans on licensing

Section 5 prohibits knowing IVO misrepresentation, but its direct civil-penalty paragraph is drafted around developer violations, making Commerce licensing and revocation central to verifier discipline.

GAO must measure a small and endogenous market

Capacity, unmet demand, entry barriers, and independence depend on confidential client pipelines and funding relationships that licensed IVOs and developers may describe differently.

Tailored stop authority

An order can reach only specified development, deployment, internal use, users, purposes, access channels, safeguards, or other circumstances rather than requiring a binary shutdown.

Affiliate and collaborator reach

Affiliates, successors, assigns, and people with actual notice who act in concert or participation can be bound, limiting a developer’s ability to route restricted activity through related entities.

Model-lineage presumption

Unless an order says otherwise, it reaches fine-tuned, reinforced, quantized, pruned, or merged versions and later models trained substantially on the named model’s outputs, weights, or internal representations.

Rapid provisional intervention

A provisional order can issue on a preliminary determination before the final finding and without a technical assessment. Prior notice and cure can be omitted when imminence forecloses them, but Commerce must promptly provide an opportunity to cure after service.

Time limits and fresh findings

A final order can issue only while the same or a substantially similar provisional order remains in effect and after the required finding and hearing window. A provisional order generally lapses within 45 days, a final order within 90 days, and each renewal requires a new finding based on current facts rather than a rote extension.

Corrective off-ramp

Orders state rescission criteria and corrective action when available, Commerce must rescind once the criteria are satisfied or imminent risk no longer exists, and a developer can seek a decision on rescission within 14 days.

Asymmetric publication

Final orders, renewals, and rescissions must be published with justified redactions, while provisional orders are reported to Congress but are not expressly included in the public-publication command.

High-stakes enforcement

A continuing violation can draw up to $10 million per violation per day, DOJ can obtain an injunction without the ordinary irreparable-harm showing, and a willful violation can carry up to $1 million, ten years’ imprisonment, or both.

The Secretary must act under severe uncertainty

Evidence about emergent capability may be incomplete when speed matters most, and a technical assessment is mandatory before a finding only if Commerce has already published methods bearing on that finding.

Commerce and developers must resolve model lineage

Distillation, merging, shared representations, output-generated training data, quantization, and pruning can make “trained, in substantial part” and order scope technically contestable.

Third parties need actual notice and clear boundaries

Binding a non-developer collaborator requires actual notice and concerted participation, which can be difficult to establish across cloud, distribution, research, and open-model relationships.

Commerce must support every renewal with current facts

Successive 90-day periods require new written findings, technical analysis where applicable, updated rescission criteria, and congressional reporting under continuing operational pressure.

DOJ must prove willfulness for criminal cases

Complex model families, evolving restrictions, and distributed control can make it difficult to prove that a person knowingly crossed an emergency order’s technical boundary.

Expedited administrative record

A developer has ten days to request a hearing, Commerce has 30 days to decide, the developer receives the relied-on materials, and Commerce bears the burden of showing adequate evidence.

Deferred ordinary judicial review

A provisional order is not final agency action and ordinarily cannot be reviewed, enjoined, limited, suspended, or stayed by a court until Commerce issues a final order.

Concentrated and non-staying review

The D.C. District Court has exclusive jurisdiction, must expedite the case, and does not automatically stay the order; the D.C. Circuit hears an expedited appeal.

Constitutional safety valve

The jurisdiction limits do not foreclose a Federal constitutional challenge to §8 or to the Secretary’s structure or authority.

Adversarial mechanism — single Federal channel

Exclusivity reaches the President and every Federal agency. An export-control, defense, cybersecurity, procurement, or law-enforcement action can be challenged if its purpose or effect rests in whole or substantial part on imminent catastrophic risk and it did not follow §8.

Unauthorized-action remedy

A covered Federal restriction taken outside §8 is unenforceable, and the affected developer can seek declaratory or injunctive relief, making the threshold characterization of an agency’s purpose consequential.

Commerce and courts must decide dense records quickly

Thirty-day administrative schedules and expedited court review must handle classified, trade-secret, technically novel, and potentially incomplete evidence.

Developers bear immediate pre-final consequences

The order remains effective while ordinary judicial access is deferred, and filing a later challenge does not itself stay the restriction.

Other Federal agencies must characterize their purpose

Agencies must decide whether an action is grounded “in whole or in substantial part” in imminent catastrophic risk or instead rests on another statutory purpose outside the exclusive channel.

The executive branch and courts face a structural dispute

Express inclusion of the President and the restriction on authority under other laws invite separation-of-powers and statutory-interpretation challenges.

Safety administration has a single-point-of-failure risk

If Commerce cannot use §8 promptly, exclusivity can prevent another Federal actor from substituting a faster restriction on the same imminent-risk ground.

Broad covered subject areas

Preemption reaches developer disclosures about frameworks, risk tests, red-team methods and results, model characteristics, third-party audits and certifications, access to technical material for verification, and safety or security incident reporting.

Uniformity and compliance consolidation

A developer need not satisfy different State substantive regimes in the covered areas, reducing multi-State duplication and eliminating stricter State experiments within the preempted field.

Adversarial mechanism — preemption exceeds affirmative coverage

Federal transparency and audit duties depend on a frontier model and sometimes large or very-large financial thresholds, while §9 preempts covered State duties for builders or owners of any AI model. Developers outside the Federal tiers can therefore lose State duties without gaining equivalent Federal ones.

Conditional downstream carveout

States may regulate AI use or deployment through consumer, civil-rights, contract, criminal, or privacy law only if the measure does not impose substantive developer duties concerning development, training, evaluation, or release.

Express minors and procurement savings

States retain targeted authority over sexually explicit content, self-harm content, exploitation, age verification, parental controls, similar harms to minors, and their own procurement or use of AI systems.

Mixed-role ambiguity

Only an entity that is solely a deployer is excluded from the developer definition, so a vertically integrated firm that both develops and deploys can complicate application of otherwise preserved downstream rules.

States and courts must classify laws field by field

“New substantive obligations,” “target artificial intelligence developers,” “solely a deployer,” and the boundary between model development and downstream use are not fully defined.

Mixed statutes may resist a binary answer

A single State law can combine developer disclosure, downstream consumer protection, minors safeguards, and procurement terms, requiring severability and remedy decisions rather than whole-law labels.

State enforcers may lose access to upstream evidence

A downstream consumer or civil-rights case can depend on developer testing, model characteristics, or incident records that the State may no longer compel through a covered developer-specific duty.

Federal oversight may not replace displaced State coverage

Commerce has no official census connecting every AI developer to model compute, affiliate revenue, and AI-development spending, so the size of the subthreshold gap is not directly measurable.

Analysts lack a national preemption-coded docket

No authoritative recurring dataset classifies State and local AI laws, investigations, settlements, and judgments under §9’s covered-area and carveout tests.