Congress shields AI auditors from liability for missed catastrophic risks

What it does

This bill creates a federal regulatory framework for frontier artificial intelligence models—those trained with massive computing power (10^26 operations or more)—requiring large AI developers to publish safety frameworks and undergo independent audits, while very large developers (over $5B revenue and $10B AI spending) must submit to ongoing third-party verification of catastrophic-risk mitigation. The bill establishes an Under Secretary for AI Security within the Department of Commerce to license independent verification organizations (IVOs), set safety standards, and enforce compliance through civil penalties.

Why we flagged it

The bill's primary mechanism is mandatory safety disclosure and independent verification for frontier AI developers—a regulatory framework. However, a critical rider grants broad immunity to IVOs from liability for catastrophic harms, which is substantively unrelated to the safety-oversight purpose and fundamentally undermines accountability.

• Section 5(e)(1) grants IVOs blanket immunity from suit for losses caused by catastrophic risks they assessed, with only a narrow exception for willful misconduct—unrelated to the bill's stated safety-verification purpose.

What the text implies

• IVOs are shielded from liability even if their assessments are negligent or inadequate, creating perverse incentives for auditors to rubber-stamp developer claims rather than conduct rigorous verification.
• The bill defines 'acceptable levels of catastrophic risk mitigation' circularly—as risk mitigation 'adequate to ensure anticipated benefits outweigh catastrophic risk'—giving developers and IVOs wide discretion to rationalize deployment of high-risk models.
• Very large developers must disclose catastrophic-risk assessments to the Under Secretary, but the bill allows broad redactions for 'trade secrets' and 'risk-prevention mechanisms,' potentially gutting public transparency despite the stated transparency mandate.
• The IVO licensing regime is entirely delegated to the Under Secretary via regulation (180-day deadline), meaning the actual safety standards, audit methodologies, and conflict-of-interest rules are not in statute and can be weakened without congressional action.
• State Attorneys General must 'opt in' to receive reports, creating a two-tier enforcement system where states that do not opt in receive no information about frontier AI risks in their jurisdictions.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

The bill creates meaningful public transparency and safety oversight for high-risk AI systems that could cause mass harm, requiring developers to disclose frameworks and submit to independent audits—a genuine public benefit. However, the bill grants broad immunity to IVOs from liability for catastrophic harms they fail to detect, and the verification regime may be captured by industry-friendly auditors, creating a false sense of safety while shielding developers from accountability.

Who stands to gain

• independent verification organizations (IVOs) licensed under the bill
• large frontier AI developers (exempted from most requirements if below $5B revenue threshold)
• AI infrastructure and chip manufacturers (regulatory clarity may reduce uncertainty)

Named in the bill

Department of Commerce, Under Secretary for AI Security, Independent Verification Organizations (IVOs), Large Frontier Developers, Very Large Frontier Developers, Attorney General, State Attorneys General, AMD, HPE, Cisco, Cognizant, Verisign

Where it stands

11 cosponsors: 6 Democrats, 5 Republicans.

• Jul 23, 2026 — Introduced · Congress.gov: “Introduced in House”
• Jul 23, 2026 — Referred to House Committee on Science, Space, and Technology and House Committee on Energy and Commerce · Congress.gov: “Referred to the Committee on Energy and Commerce, and in addition to the Committee on Science, Space, and…”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.