AI Risk Management and Security Act (S. 5576) Guide

The Artificial Intelligence Risk Management and Security Act of 2026 would make frontier AI developers hand their models, including weights, to a federal AI Safety Board at least 45 days before release, and would make the Board's security standards enforceable with daily fines. Senator Mark Warner (Democrat, Virginia) introduced it as S. 5576 with Senators Brian Schatz (Democrat, Hawaii) and Andy Kim (Democrat, New Jersey), and it was referred to the Senate Commerce Committee on 29 September 2026. The same day, Senator Ted Cruz blocked an attempt to pass it by unanimous consent. It is a bill, not a law, and as of November 2026 it sits in committee. This guide works from the introduced text on govinfo.gov and explains the Board, the 45 day access rule, Model Safety Plans, incident reporting, the agent provisions and what security and identity teams can prepare now.

Source note: obligations, clocks and figures come from the introduced bill text unless another source is named. Senator Warner's press release, Implicator, Let's Data Science, PYMNTS and FastDemocracy are used for status and context. Bills change in committee. Confirm against the official text before relying on it.

Key takeaways

A standards body with teeth. A permanent AI Safety Board in the Department of Commerce would propose security and evaluation standards within 90 days of being set up; the Secretary of Commerce would adopt them by rule within 30 days and developers must comply.
45 days of pre-release access. Developers must give the Board access to a frontier model, including weights, configuration files, runtimes and the libraries needed to run it, at least 45 calendar days before it enters commerce. The text gives the Board no power to approve or block release.
Fines of up to 250,000 US dollars a day. Violating adopted standards carries a civil penalty of up to 250,000 US dollars per violation, each day a separate violation, enforced by the Attorney General at the Secretary's request.
Two incident clocks. Frontier developers and critical infrastructure operators using AI in industrial control or operational technology must report AI safety and security incidents within 30 days of confirmation, or 72 hours where there is an imminent threat.
Agent identity is written in. NIST would have 18 months to publish an Agentic AI Profile of the AI RMF covering autonomy levels and agent identity, authentication and authorisation, plus a standard agent documentation template.

Status and timeline

Date	Event	Source
24 September 2026	Warner, Schatz and Kim announce the bill and publish its text	Warner press release
29 September 2026	Formally introduced as S. 5576, read twice, referred to the Committee on Commerce, Science, and Transportation	Bill text on govinfo.gov; FastDemocracy
29 September 2026	Unanimous consent request on the Senate floor; Senator Cruz, Commerce Committee chair, objects	Implicator; Let's Data Science
29 September 2026	The President and several AI companies sign a voluntary frontier safety accord	Implicator
November 2026	In committee; no hearing or markup reported in our sources	FastDemocracy

Cruz said the bill gave the Board and the Department too much power over which technologies could be released, and that federal standards must also address state AI laws (Implicator). He is reported to be drafting a separate catastrophic risk bill with Senators Thune and Klobuchar, whose terms are not public. Because the committee chair opposes this text, passage in its current form looks unlikely, but its definitions and agent provisions are likely to reappear in later bills. Do not confuse it with Warner's separate Secure AI Act (S. 5061), which proposes 21 days of National Security Agency access and fines of at least 100,000 US dollars a day (King and Spalding).

Who and what is covered

Term	Meaning in the bill	Practical reading
Frontier AI model	A model, or combination of models, that exhibits or could be modified to exhibit high performance at tasks posing a serious risk to national security, national economic security, or public health or safety	Capability based, with no compute or revenue threshold; "could be modified to" brings in models that only need fine tuning to cross the line
Developer	A developer of a frontier AI model	Size does not matter; the Board must make recommendations on resourcing for small and medium developers
AI agent	A system that determines the actions needed to reach an objective and can execute them directly on information systems, data or external services; advisory only systems are excluded	Agents with tool or API execution rights are in; chat assistants that only answer are out
AI safety incident	An event that materially increases the risk that operation endangers human life, health, property or the environment	Outcome risk, not actual harm
AI security incident	An event that materially increases the risk of unauthorised extraction of system information or manipulation that undermines confidentiality, integrity or availability	Covers weight theft attempts, prompt extraction and tampering
AI security vulnerability	A weakness a third party could exploit, including data poisoning, evasion, privacy attacks, model theft and safety circumvention	Maps closely to adversarial ML catalogues such as MITRE ATLAS
Critical infrastructure operator	Operators using AI in industrial control systems or operational technology (defined by reference to 42 U.S.C. 5195c(e))	Non-developers with a direct reporting duty

One drafting gap matters: the text uses "provider" in places without defining it. Hosts and resellers of frontier models should take advice on whether they would be treated as providers for incident reporting.

The AI Safety Board

Set up: by the Secretary of Commerce within 30 days of enactment, as a permanent advisory committee, with its first meeting and bylaws within 60 days. Staffed by NIST's Center for AI Standards and Innovation (CAISI).
Members: one each selected by the NIST Director, the Secretary of Commerce, the CISA Director, the NSA Director and the Secretary of the Treasury, plus non-federal experts (technical experts inside and outside developers, evaluation design, consumer protection and antitrust). Terms of up to three years with one reappointment; members need Top Secret clearance and are removed if it is denied.
Duties: evaluation processes for high risk capabilities; risk metrics covering unreleased versions and checkpoints; technical standards and conformity assessment, including model card formats, cybersecurity measures and insider risk controls; and security standards for test environments, covering isolation, real-time monitoring, identity safeguards and prompt termination of evaluations. Standards are reviewed at least yearly.
Secure test beds: NSA and Department of Energy national laboratory environments may be used, and offered to industry and independent experts on a cost recovery basis.

The test environment standard is effectively an identity and containment specification for evaluation harnesses. See AI Lab and Agent Evaluation Incidents and the AI Security Evaluations Guide.

Key obligations for developers

Obligation	Section	Clock	Penalty expressly attached?
Comply with adopted Board standards	3(c)	From adoption by rule	Yes: up to 250,000 US dollars per violation per day
Give the Board model access (weights, configuration files, runtimes, libraries)	3(f)	At least 45 calendar days before release into commerce	Not expressly; penalties in 3(d) refer to 3(c)
Develop, publish, follow and file a Model Safety Plan naming a responsible corporate officer	4	For each model created, substantially modified or used to train or evaluate other models	Not expressly
Report AI safety and security incidents	5	30 days after confirmation; 72 hours if imminent threat to national security, critical infrastructure or public safety	Not expressly

The enforcement gaps in the last three rows are our reading of the introduced text. Committee drafting would very likely close them, so plan as if all four duties will be enforceable.

Model Safety Plans

Each plan identifies the model, sets out the developer's capabilities or risk assessment (covering chemical, biological, radiological and nuclear uplift, evasion of developer control, cyber threat facilitation, weight exfiltration or malicious modification, and theft or misuse by unauthorised users), lists mitigations across the lifecycle and names the accountable officer. Several of those risks are access control failures. See the Frontier AI Model Risk Frameworks Guide and Securing AI Model Weights.

Incident database

NIST, working with CISA, would open voluntary reporting channels within 180 days and a public incident database and flaw catalogue with common flaw identifiers within a year. Information shared would be exempt from FOIA disclosure, would not waive trade secret privileges and affected parties would be anonymised unless they consent. NIST would also issue non-binding guidance within 180 days on what "materially increases" risk. See the AI Incident Reporting Guide.

What it means for AI agents and non-human identities

Section 6 is the first federal bill text we have seen that directs NIST to standardise agent identity. Within 18 months NIST would publish an Agentic AI Profile of the AI RMF (NIST AI 100-1) defining novel or amplified agent risks, classifying autonomy levels and addressing agent identity, authentication and authorisation in relation to the Cybersecurity Framework. It would also start a common agent documentation template.

Template element in the bill	Where it lives today	Gap to close
Identity and version	Agent registry, workload identity	Unique identity per agent, not a shared service account
Intended use	Design documents	Recorded per agent and reviewed at change
Ownership and authority	CMDB or IGA owner field	Named human owner and delegated authority limits
Access to data and tools	OAuth grants, API keys, MCP server configuration	Machine readable entitlement list
Evaluations and independent evaluator	Red team reports	Linked to the agent record
Known limitations	Rarely recorded	Documented and shown to approvers

Organisations that already keep this record will meet the template whether or not the bill passes. See the AI agent registry, the AI Agent Autonomy Levels Framework and the Agent Identity and Access Guide.

Decision guidance

Frontier developers: treat 45 day pre-release access as a release engineering constraint. Your release calendar needs a frozen candidate, a secure transfer path for weights and a way to evidence what was provided and when.
Critical infrastructure operators: you would have a direct 30 day and 72 hour duty if you use AI in ICS or OT. Inventory those uses now. See the AI in OT and Industrial Systems Guide.
Enterprises consuming models: no direct duty, but expect model providers to ask for incident cooperation and to pass Board standards into contracts.
Small developers: there is no size threshold. Watch the Board's resourcing recommendations and the secure test beds offered at cost.
This bill or the voluntary accord: the September 2026 accord relies on internal controls and an external evaluator without a statutory enforcer. Evidence built for this bill (access logs, incident records, evaluator reports) also satisfies the accord, so build once.

Compliance steps

Decide whether any model is "frontier": run a documented capability assessment against the bill's risk list, including what fine tuning could unlock.
Name the accountable officer for each Model Safety Plan and record the plan's scope.
Build a pre-release access path: a release gate 45 days before launch, an approved secure transfer or test bed route, and a signed record of artefacts provided.
Lock down weight access: enumerate every human and non-human identity that can read, copy or export weights, remove standing access and log every read.
Set up the two incident clocks: 72 hours for imminent threats and 30 days otherwise, with a triage step that decides "materially increases risk".
Record agents to the template: identity, owner, authority, tools, evaluations and limitations.
Pilot and test: run a mock 45 day access exercise and an incident tabletop before relying on the process.
Roll back if the bill changes: the inventory, plans and incident path also serve California SB 53, New York RAISE and the voluntary accord.

Detection and measurement

Weight access exposure: number of identities with weight read or export rights, and the share reviewed in the last 90 days.
Release gate lead time: days between frozen candidate and launch; must stay at or above 45.
Incident triage time: hours from detection to the "imminent threat" decision; target under 24 to protect the 72 hour clock.
Agent documentation coverage: percentage of production agents with all six template elements recorded.
Evaluation containment: evaluation runs with network egress outside the test environment (target zero), alerted from egress and identity logs.

Framework mapping

Framework	Reference	Link to the bill
NIST CSF 2.0	GV.OC-03	Legal and regulatory requirements managed
NIST CSF 2.0	PR.AA-01, PR.AA-05	Agent identity and authorisation, as the Agentic AI Profile would address
NIST CSF 2.0	RS.CO-02	Notifying incidents within 30 days or 72 hours
NIST SP 800-53 Rev 5	SA-11, CA-8	Developer testing and pre-release evaluation
NIST SP 800-53 Rev 5	AC-6, SC-28, AU-9	Weight access, encryption at rest, protected logs
NIST SP 800-53 Rev 5	IR-4, IR-6, CM-8	Incident handling, reporting and component inventory
ISO/IEC 27001:2022	A.5.31, A.5.24, A.8.15	Legal requirements, incident planning, logging

See the NIST AI RMF Guide for the framework the Agentic AI Profile would extend.

Common failure patterns

Reading "no threshold" as "not us": the capability definition can catch a mid-sized developer whose model can be fine tuned into risky capability.
Weights shared by email or ad hoc bucket: pre-release access done without a secured transfer path creates the exfiltration risk the bill targets.
Evaluation harnesses with production credentials: test environments that reuse real keys break the isolation and identity safeguards the Board would standardise.
Agents with shared service accounts: no unique identity means no usable documentation record or incident attribution. See the Shared AI Agent Credentials Guide.
Waiting for the law: the 72 hour path, weight access reviews and agent records take months to build and are useful now.

Practitioner checklist

Record whether each model meets the capability based frontier definition, and why.
Name an accountable officer per Model Safety Plan.
Design a 45 day pre-release access gate with a secure transfer route.
Review every identity with weight access and remove standing rights.
Build 72 hour and 30 day incident paths and test them.
Inventory AI used in ICS and OT if you operate critical infrastructure.
Document each agent's identity, owner, authority, tools, evaluations and limitations.
Track S. 5576 and any Commerce Committee alternative each quarter.

Standards and references

Related NHI Mgmt Group resources: US Federal AI Policy Guide · AI Kill Switch Act Guide · Great American AI Act Guide · Securing AI Model Weights. This guide summarises S. 5576 as introduced and is not legal advice.

AI Risk Management and Security Act Guide: What S. 5576 Would Require of Frontier Developers