Congress Advances Bill to Add AI to National Vulnerability Database

Congress Advances Bill to Add AI to National Vulnerability Database

September 26, 2024 at 02:37PM

The House committee advanced a bill allowing the NIST to formalize reporting of AI security vulnerabilities, facing funding concerns. The bipartisan AI Incident Reporting and Security Enhancement Act, now at full Congress, mandates NIST to incorporate AI systems into NVD. There’s concern over funding and clarifying certain terms in the bill.

From the meeting notes, it is clear that a bill, known as the AI Incident Reporting and Security Enhancement Act, has been advanced by the House Science, Space and Technology Committee. This bill aims to empower the National Institute of Standards and Technology (NIST) to establish a formal process for reporting security vulnerabilities in artificial intelligence (AI) systems. The bipartisan bill would require NIST to include AI systems in the National Vulnerability Database (NVD), with the understanding that increased workload would be “subject to the availability of funding.”

While the bill was approved in committee, there were concerns raised regarding the specific language used in the bill, with some members expressing the need for clarification of certain terms in order to improve its likelihood of passing through Congress. Additionally, the bill proposes that NIST collaborate with federal agencies, private sector organizations, standards organizations, and civil society groups to develop a common language for reporting AI cybersecurity incidents.

It is important to note that funding concerns were brought up during the meeting, highlighting the potential for budgetary constraints to impact the implementation of the bill. The meeting also underscored the ongoing efforts by committee members to address the funding and scaling challenges that NIST faces in maintaining the NVD.

In summary, the meeting notes reflect the advancement of the AI Incident Reporting and Security Enhancement Act in the House committee, drawing attention to both the potential benefits of the bill in enhancing AI system security reporting and the funding and language-related considerations that will need to be addressed for the bill to progress further.

Full Article