Cybersecurity Policy Report, Draft House AI Bill Would Help Secure Open-Source Software, (Jun 5, 2026)
Organizations Mentioned:Public Knowledge
The security of open-source software would get a boost from the provisions of draft legislation designed to establish a comprehensive regulatory framework for AI (artificial intelligence).
A “discussion draft” of the Great American AI Act would provide funding for open-source software (OSS) upgrades and would give maintainers of OSS early access to newly developed “frontier” AI models capable of finding software flaws, according to the bill’s text.
“Each developer of a covered frontier model shall provide access to that covered frontier model, for cybersecurity purposes, to each eligible maintainer of designated critical open-source software,” the draft bill says.
OSS is part of many commercial software packages used in critical infrastructure but frequently has vulnerabilities that go undetected by volunteers who maintain it.
The text of the AI bill was released yesterday by its drafters, Reps. Jay Obernolte (R., Calif.) and Lori Trahan (D., Mass.). “The discussion draft is intended to solicit feedback from stakeholders, experts, and the public before the bill is formally introduced,” they said in a news release.
“It is the result of bipartisan collaboration between the two members to ensure the United States can govern AI effectively, protect Americans from emerging risks, and continue to lead the world in AI innovation,” the lawmakers added.
The bill would require “large frontier developers”—defined as AI development companies with annual gross revenues of $500 million or more—to “publicly post a frontier AI framework covering risk thresholds and assessment procedures for catastrophic risk, model weight cybersecurity, and both internal and external deployment decisions,” according to a summary.
The frontier developers’ compliance with their published frameworks would be overseen by the Center for AI Standards and Innovation (CAISI) at the Department of Commerce. CAISI would also be empowered to “license” independent verification organizations, which would provide additional oversight of the activities of the largest frontier developers, the summary explains.
The draft bill would require frontier AI developers to report “critical safety incidents,” such as unauthorized access to an AI model, to CAISI within 15 days. A critical safety incident “that poses an imminent risk of death or serious physical injury” would have to be reported to law enforcement within 24 hours, the draft bill says.
Information-sharing about cyber incidents and vulnerabilities would be a key part of the regulatory framework proposed by the draft legislation. It would extend the Cybersecurity Information Sharing Act of 2015, which is due to expire on Sept. 30, through 2035 and would amend the law with new provisions related to AI. CISA 2015, as the law is known, enables critical infrastructure operators to discuss cyber incidents among themselves and with the federal government without legal repercussions from antitrust laws, regulatory enforcement, or lawsuits.
The bill would preempt “any state or local law or regulation specifically targeting the development of AI models,” according to the summary, but would not preempt “laws of general applicability, common law remedies, or laws regulating AI use or deployment.” The preemption provision would sunset after three years.
Rep. Erin Houchin (R., Ind.), one of several House backers of the draft bill, said state preemption was needed to give the AI sector a single national framework. “America should lead the world in artificial intelligence, not regulate ourselves into falling behind China through a patchwork of fifty different state laws,” Rep. Houchin said.
“That approach would make it harder for American companies to innovate and compete while doing little to improve consumer protections. This bill creates a clear national standard for how AI models are developed while preserving the ability of states and parents to protect children,” she added.
Jason Oxman, president and chief executive officer of the Information Technology Industry Council, also saw merit in the draft bill’s preemption provision. “Congress must set a national standard that enables responsible AI development, deployment, and adoption across the American economy,” Mr. Oxman said in a statement.
“We are encouraged that the Great American AI Act includes key elements that will accelerate American AI leadership including codification of the National Artificial Intelligence Research Resource, promote U.S. leadership in international standards development, extend the Cybersecurity Information Sharing Act of 2015, and expand research for next-generation data center efficiencies,” he said.
Other groups were less supportive of preemption. “The sweeping preemption clause in this bill goes far beyond replacing state laws that might conflict or duplicate this federal framework,” noted Nicholas Garcia, senior policy counsel at Public Knowledge.
“As it currently stands, this is just the ‘Pretty Good American AI Act’ because the preemption clause undercuts the state measures that build the public trust AI adoption actually requires. And to be really great, Congress would have more work to do: investing in open and public AI infrastructure to keep AI competitive and broadly accessible, and establishing the privacy, consumer protection, and user control rules we urgently need,” Mr. Garcia said in a statement.
Samir Jain, vice president–policy at the Center for Democracy and Technology, described the draft bill as a laudable step toward “creation of the institutional tools required for necessary testing and oversight mechanisms” for AI.
“However, the primary focus on establishing transparency obligations regarding catastrophic risk is a missed opportunity to engage with the broader set of concerns,” Mr. Jain said. “This bill ostensibly attempts to impose narrow preemption, but significant questions remain about whether that provision will allow AI companies to game the system and overturn far more state laws than intended. We hope the bill improves to in fact create and maintain the guardrails necessary for these tools to be developed and deployed safely.”
News: FederalLegislation StateLegislation DataSecurity AINews