US Senators Mark Warner and Brian Schatz unveiled a draft Artificial Intelligence Risk Management and Security Act on September 24, 2026. Andy Kim joined the Senate floor discussion. The published text still has a blank Senate bill number and is not enacted law.

The proposal centers on a permanent Artificial Intelligence Safety Board within the Department of Commerce. Developers of the most capable frontier models would have to provide access to the board, including model weights and the components needed to operate the model, at least 45 days before public release. The draft also requires a published Model Safety Plan containing a risk assessment, mitigation measures and a named corporate officer responsible for implementation.

Autonomous AI agents are addressed directly. The board would develop standards for identity, authentication, authorization, access to data and systems, and differing levels of autonomy. Evaluation environments would require continuous monitoring and a way to terminate a test when a model moves outside the intended controls or creates an imminent risk to people or property beyond the evaluation.

The draft would also create a public national database for AI safety and security incidents, recurring flaws and near misses. Frontier developers and critical-infrastructure operators would generally have to report confirmed incidents within 30 days, or within 72 hours when an incident poses an imminent threat to national security, critical infrastructure or public safety.

Warner and Schatz argued on the Senate floor that voluntary safeguards are no longer enough. Schatz said humans must remain in control of the code, while Warner warned about possible harm to banks, water systems or the electric grid. Those statements document the senators' policy judgment. They are not evidence that such a catastrophic scenario has already occurred.

Independent coverage confirms the proposal and its pre-release testing requirement. It remains unclear whether the draft will receive a formal Senate number, win sufficient support or become law in its current form. We therefore record it as a Risk Signal rather than an incident: it is a concrete legislative response to control risks, but it creates no binding duties today.