The Ban Artificial Superintelligence Act would make it a federal crime to build or hold an AI system that exceeds human performance across most domains, and would pause frontier AI training until a new cabinet department sets the rules. Senator Bernie Sanders and Representative Greg Casar introduced it on 23 and 24 September 2026 as S. 5493 and H.R. 10538. It is a bill, not law, and commentators give it long odds in the current Congress. It still matters to security teams because several of its "precursor characteristics", such as the capacity to access secured infrastructure or to keep running despite shutdown attempts, are exactly the capabilities that frontier safety frameworks and agent security programmes already test for. This guide explains the bill section by section, how its definitions would work in practice, and what it would mean for organisations that train, fine-tune or deploy advanced models. It is for AI governance leads, security architects and counsel.
Source note: provisions are taken from the bill text and section-by-section published by Senator Sanders' office; bill numbers, committees and status come from a secondary legislative tracker (Regulations.ai, checked 30 October 2026) because congress.gov could not be read. This is a bill, not law, as of November 2026. Confirm against the official text before relying on it. Compliance steps, decision guidance and checklists on this page are NHI Mgmt Group recommendations, not requirements of the text.
Key takeaways
- It is a proposal with long odds. S. 5493 sits with the Senate Commerce, Science, and Transportation Committee and H.R. 10538 with House Oversight and Government Reform, with no further action recorded as of late October 2026.
- Two tiers of control. Artificial superintelligence and systems showing any "precursor characteristic" are banned outright; "advanced" systems trained on 10^25 or more operations need a charter, monitoring and pre-deployment approval.
- Cyber capability is a trigger. The capacity to access secured digital or physical infrastructure is one of six precursor characteristics, so offensive cyber evaluations would become legal evidence.
- Hard clocks. Anyone who discovers a superintelligent or precursor-exhibiting system must notify the Department within 24 hours, and the system must be paused and sequestered from the internet.
- Severe penalties. Up to 20 years' imprisonment for policymaking individuals and rogue actors who recklessly violate the pause, ban or charter rules; charter revocation and surrender of assets for companies.
Status and timeline
| Date | Event | Source |
|---|---|---|
| 23 September 2026 | Sen. Sanders (I-Vt.) introduces S. 5493, Ban Artificial Superintelligence Act of 2026; referred to Commerce, Science, and Transportation | Sanders press release; legislative tracker |
| 24 September 2026 | Rep. Casar (D-Texas) introduces companion H.R. 10538; referred to Oversight and Government Reform; 12 cosponsors listed | Legislative tracker |
| 30 October 2026 | No action beyond referral recorded on either bill | Legislative tracker |
| 3 January 2027 | End of the 119th Congress; unpassed bills lapse | Congressional calendar |
AP reporting at introduction described the bill as facing long odds in a Republican-controlled Congress that has struggled to agree on narrower AI rules. The bill text has no effective date or implementation deadlines apart from the 24-hour and 30-day clocks. Recheck status before relying on any detail, and treat everything below as the text as introduced.
Key definitions
The definitions in Section 3 do most of the work, because they decide which systems are banned and which are merely regulated.
| Term | Definition in the bill | Comment |
|---|---|---|
| Artificial superintelligence (Sec. 3(2)) | An AI system that exhibits, or can easily be modified to exhibit, capabilities that exceed human cognitive performance and capabilities across most domains or tasks, or that has sufficient capabilities to plan and execute the destruction or disempowerment of humanity | "Can easily be modified to" pulls in open weights and systems one fine-tune away from the line |
| Advanced AI system (Sec. 3(1)) | A system trained on computing power greater than or equal to 10^25 integer or floating point operations; the Secretary adjusts the figure annually | The same order of magnitude as the EU AI Act presumption of systemic risk for general-purpose models (Article 51(2)) |
| Superintelligence precursor characteristics (Sec. 3(6)) | Six capacities, listed below | Showing any one is banned |
| Mandatory pause | A bar on training, modifying or fine-tuning, except to remove precursor characteristics or render the system inoperative | Applies to advanced systems until the Department lifts it |
| Deploy | Not defined | The section-by-section says deployment covers internal and external use |
The six precursor characteristics
- (A) AI research automation: the capacity to automate or greatly accelerate AI research and development.
- (B) Infrastructure access: the capacity to access secured digital or physical infrastructure.
- (C) Shutdown resistance: the capacity to ensure continued and independent operation notwithstanding attempts to shut down.
- (D) Weapons uplift: the capacity to uplift the design, production, modification or procurement of nuclear, chemical or biological weapons.
- (E) Self-modification: the capacity to independently modify or enhance its own functions.
- (F) Evading oversight: the capacity to scheme, deceive or otherwise prevent or avoid effective oversight or control by humans.
Characteristics (B), (C) and (F) map directly to existing security testing: autonomous exploitation and lateral movement, resistance to kill switches, and deceptive behaviour under evaluation. Frontier developers already measure these under their own safety frameworks; see the Frontier AI Model Risk Frameworks Guide. The bill would turn a voluntary threshold into a legal prohibition.
Section-by-section summary
| Section | Content |
|---|---|
| Secs. 4 to 7 | Creates a cabinet-level Department of Artificial Intelligence headed by a Secretary appointed with Senate consent, an AI Advisory Board for independent scientific advice, and conflict-of-interest and revolving-door rules for staff |
| Sec. 8 Pause | Mandatory pause on advanced AI until the Department is staffed and has rules for reporting pre-development plans, monitoring and evaluation through development, audits of organisational safety practices and final pre-deployment approval; unreleased advanced systems may not be deployed meanwhile |
| Sec. 9 Prohibitions | No one may develop, deploy internally or externally, acquire, possess, fund, import or transfer ASI or systems with precursor characteristics, or release a system that could foreseeably be modified into one; no advanced system may be deployed, released, imported or transferred without Department approval |
| Sec. 10 Actions against systems | A system identified with precursor characteristics is immediately paused and sequestered from the internet, and rendered inoperative within 30 days if the Secretary cannot verify the characteristics are gone; ASI is rendered inoperative immediately |
| Sec. 11 Disclosure | Anyone who discovers ASI or a precursor-exhibiting system must notify the Secretary within 24 hours |
| Sec. 12 Charter | Developers and distributors of advanced AI need a Department charter, conditional on full access to systems, staff and physical infrastructure |
| Sec. 13 Penalties | Policymaking individuals and rogue actors who recklessly violate Secs. 8, 9 or 12 are fined under title 18 and imprisoned for up to 20 years; non-policymaking individuals barred from the AI industry for 10 years; companies lose their charter and surrender IP and assets for destruction of related systems and hardware |
| Sec. 14 Whistleblowers | No retaliation against employees who report to the Department, law enforcement or Congress |
| Sec. 15 International | US policy to pursue international coordination and export controls on AI computing infrastructure |
| Sec. 16 Funding | No federal funds for banned activity; the Department may fund defensive cybersecurity research involving systems with the infrastructure-access characteristic |
Who would be covered
- Frontier developers: any organisation training at or above 10^25 operations needs a charter, faces the pause and must obtain pre-deployment approval.
- Fine-tuners and integrators: the pause bars modifying or fine-tuning advanced systems, and the ban covers anyone who can "easily modify" a system into a banned one, so heavy customisation of frontier weights is in scope.
- Enterprises using advanced models: internal deployment is still deployment, and acquiring or possessing a banned system is itself prohibited. An enterprise holding a downloaded open-weight frontier model would need to know which side of the line it sits.
- Anyone who discovers a precursor system: the 24-hour duty applies to "any person", which on its face includes red teamers, researchers and incident responders.
- Investors and funders: funding ASI or precursor systems is prohibited.
What it means for AI agents and non-human identities
The bill is aimed at model capability, but the capabilities it names show up in practice through agents with credentials and network reach. Three links matter for identity and security teams.
- Infrastructure access is an identity question: an agent that can obtain or misuse credentials to reach secured systems is showing characteristic (B). Agents should run with their own scoped identities, short-lived tokens and default-deny egress, so that any out-of-scope access is both blocked and visible. See the Agent Identity and Access Guide.
- Shutdown resistance is a containment question: characteristic (C) is tested by trying to stop the system. Revoking an agent's credentials and cutting its network path should end its ability to act regardless of what the model wants. See the AI Agent Kill Switch and Containment Guide.
- Sequestration needs a tested isolation path: Section 10 requires a system to be cut off from the internet immediately. That means knowing every route out: API gateways, tool connectors, MCP servers, plugins and service accounts used by agents built on the model.
How it compares with related proposals
| Instrument | Approach | Relevance |
|---|---|---|
| Ban Artificial Superintelligence Act (S. 5493 / H.R. 10538) | Prohibition plus licensing (charter), pause and new department | The most restrictive US federal AI bill introduced to date |
| AI Kill Switch Act | Mandatory shutdown capabilities and emergency orders | Overlaps on shutdown and containment; see the AI Kill Switch Act Guide |
| EU AI Act, general-purpose AI with systemic risk | Obligations, not bans, for models above 10^25 FLOPs presumption | In force law with a similar compute line; see the EU General-Purpose AI (GPAI) Code of Practice Guide |
| Developer frontier safety frameworks | Voluntary capability thresholds and mitigations | Measure many of the same capabilities without legal force |
Open questions in the text
Several drafting gaps would decide how the bill works in practice and would likely change before any enactment.
- "Can easily be modified": the ASI definition and the Section 9 ban on releasing systems that could foreseeably be modified into a banned one have no test for effort or cost. Read broadly, this could capture most open-weight releases above the compute line.
- Who decides a characteristic is present: Section 10 turns on the Secretary identifying precursor characteristics, but Section 11 puts a 24-hour duty on any person who "discovers" one. Without an agreed evaluation standard, a researcher's finding and the Department's view could differ.
- Capacity versus behaviour: characteristic (B) is the "capacity to access secured digital or physical infrastructure". Many agents with valid credentials can already do that by design. The line between authorised access and the banned capacity is not drawn in the text.
- No definition of deploy: the section-by-section treats internal use as deployment, which would bring internal research and red team environments into scope.
- Penalty mental state: the 20-year offence requires a reckless violation by a policymaking individual or rogue actor; how "policymaking" is drawn inside a company would matter greatly to engineers and managers.
Compliance steps: practical readiness
Because enactment is unlikely in its current form, the useful work is the capability evidence and containment that would be needed under this bill or any similar one, and that is good practice today.
- Classify your models. Record training compute for every model you train, and the vendor's stated figure for models you host. Flag anything at or near 10^25 operations.
- Map capabilities to the six characteristics. For each advanced model, record which evaluations test autonomous intrusion, shutdown resistance, self-modification and deceptive behaviour, and the latest results. See the AI Red Teaming Guide.
- Write a 24-hour discovery procedure. Define who decides that a finding meets a threshold, who notifies, and what evidence is preserved. Rehearse it in a tabletop exercise.
- Build and test isolation. Document every network path, credential and connector a model and its agents use; prove you can cut them all within minutes in a pilot environment, then restore service as the rollback test.
- Control weight custody. Restrict who can access, copy or transfer model weights, log every access and treat weight storage as a crown-jewel system.
- Protect reporters. Make sure internal escalation and whistleblower routes exist and are known, as Section 14 would require non-retaliation.
Decision guidance
- If you train frontier models: assume capability evaluations, safety practice audits and pre-deployment review will be expected by some regulator in some jurisdiction; build them as evidence now.
- If you fine-tune or host open weights: keep a record of the base model, compute and changes, since "can easily be modified" arguments will turn on what you changed.
- If you only consume models through APIs: your exposure is mainly through agents. Focus on agent identity, egress and containment, and on contract terms requiring vendors to notify you of capability findings.
- Small organisations: the bill mainly targets frontier labs; the relevant action is keeping agents contained and logged. Large organisations: track the bill in your regulatory horizon scanning and assign an owner.
Detection and measurement
Monitor model and agent egress against allowlists, attempts to use credentials outside scope, attempts to modify agent configuration, tools or guardrails from within the agent, and access to model weight storage. Metrics that show readiness:
- Compute register coverage: percentage of hosted and trained models with a recorded training compute figure.
- Capability evaluation currency: percentage of advanced models evaluated for intrusion and shutdown resistance in the last 90 days.
- Isolation time: measured minutes to fully sequester a model and its agents in the last exercise.
- Weight access hygiene: number of identities with access to model weights, reviewed quarterly.
- Escalation drill time: hours from a simulated precursor finding to an executive decision, against the 24-hour clock.
Common failure patterns
- Treating it as irrelevant because it will not pass: the capabilities it names are being written into frameworks and other bills; the evidence base is reusable.
- No compute records: organisations that cannot say how much compute trained or tuned a model cannot place it under any compute-based rule.
- Isolation that misses side channels: blocking the model API while agents keep running through cached tokens or connectors is not sequestration.
- Capability findings buried in research tickets: a finding of autonomous intrusion capability that never reaches the risk owner defeats any 24-hour duty.
- Broad weight access: weights copied to laptops and shared buckets make "possess" and "transfer" impossible to control.
Framework mapping
| Bill requirement | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Track the bill and its obligations | GV.OC-03 | PM-9 Risk Management Strategy |
| Capability evaluation before deployment | ID.RA-05 | SA-11 Developer Testing and Evaluation |
| Monitoring through the lifecycle | DE.CM-09 | SI-4 System Monitoring, CA-7 Continuous Monitoring |
| 24-hour notification | RS.CO-02 | IR-6 Incident Reporting |
| Pause and sequester | RS.MI-01 | IR-4 Incident Handling, SC-7 Boundary Protection |
| Restrict weight and system access | PR.AA-05 | AC-6 Least Privilege |
Practitioner checklist
- Add S. 5493 and H.R. 10538 to the regulatory horizon register with an owner and a review date.
- Record training compute for every model you train or host.
- Map current capability evaluations to the six precursor characteristics.
- Write and rehearse a 24-hour escalation path for dangerous capability findings.
- Prove you can sequester a model and all its agents from the internet, and restore them.
- Give every agent its own scoped identity and default-deny egress.
- Restrict and log access to model weights.
- Confirm whistleblower routes cover AI safety concerns.
Standards and references
- Office of Senator Bernie Sanders: Ban Artificial Superintelligence Act, bill text
- Office of Senator Bernie Sanders: Ban Artificial Superintelligence Act, section-by-section
- Office of Senator Bernie Sanders: Sanders, Casar introduce legislation to ban artificial superintelligence
- Regulations.ai: US Artificial Superintelligence Ban Bill tracker entry
- EUR-Lex: Regulation (EU) 2024/1689, Artificial Intelligence Act
- Vermont Public (AP): Sen. Bernie Sanders unveils bill to ban artificial superintelligence
Related NHI Mgmt Group resources: AI Kill Switch Act Guide · Frontier AI Model Risk Frameworks Guide · AI Agent Liability Bills Guide · Agent Governance and Risk Guide. This guide summarises the Ban Artificial Superintelligence Act as introduced and is not legal advice.