AI companies get classified threat intel—but public gets anonymized incidents only

What it does

This bill creates a federal framework for tracking and testing artificial intelligence systems before they are released to the public. It establishes an AI Risk Board to evaluate which AI models pose serious national security or public health risks, requires developers to submit frontier AI models to the National Security Agency for review 21 days before public release, creates a public database of AI security and safety incidents, and sets up a pilot program to share classified threat intelligence with AI companies about foreign adversaries targeting their systems.

Why we flagged it

The bill's core function is pre-release AI testing and incident tracking (regulatory), but a substantial portion establishes a classified intelligence-sharing pilot program that runs to private AI companies—a public-private intelligence partnership that is unusual and asymmetric in its disclosure protections.

What the text implies

• The bill exempts all threat intelligence shared with AI companies from FOIA disclosure (5 U.S.C. § 552(b)(3)), creating a permanent classified channel between NSA and private firms with no public audit trail of what foreign threats are being disclosed or to whom.
• Companies participating in the intelligence-sharing pilot gain liability protection (no cause of action) for sharing information with government or other companies, but the bill does not reciprocally require companies to disclose what they learn about foreign threats to the public or to non-participating competitors.

The full analysis lists 5 implications of this text.

Who stands to gain

AI model developers and providers (frontier AI companies); Cybersecurity and infrastructure security contractors; National security contractors with cleared personnel