H.R. 8094

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[H.R. 8094 Introduced in House (IH)]

<DOC>

119th CONGRESS
2d Session
H. R. 8094

To direct the Federal Trade Commission to establish requirements for 
making information available to the public about the training data and 
algorithms used in artificial intelligence foundation models, and for 
other purposes.

_______________________________________________________________________

IN THE HOUSE OF REPRESENTATIVES

March 26, 2026

Mr. Beyer (for himself, Mr. Lawler, and Ms. Jacobs) introduced the 
following bill; which was referred to the Committee on Energy and 
Commerce

_______________________________________________________________________

A BILL

To direct the Federal Trade Commission to establish requirements for 
making information available to the public about the training data and 
algorithms used in artificial intelligence foundation models, and for 
other purposes.

Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the ``AI Foundation Model Transparency Act 
of 2026''.

SEC. 2. ELEMENTS OF FOUNDATION MODEL TRANSPARENCY.

(a) Establishment of Requirements.--Not later than 1 year after the 
date of the enactment of this Act, the Commission, in consultation with 
the Director of the National Institute of Standards and Technology, the 
Secretary of Commerce, the Director of the Office of Science and 
Technology Policy, and other relevant stakeholders (including standards 
bodies, covered entities, academia, technology experts, and advocates 
for civil rights and consumers), shall do the following:
(1) In accordance with section 553 of title 5, United 
States Code, promulgate regulations that:
(A) Establish requirements for covered entities 
with regard to foundation models to improve 
transparency of training data, documentation, testing, 
data collection during inference, and operations of 
foundation models, before commercial deployment and 
during the lifecycle of the system.
(B) Include requirements for a covered entity--
(i) to submit specified information related 
to each foundation model provided by the entity 
to the Commission; and
(ii) to make publicly available certain 
information related to each foundation model 
provided by the entity.
(C) Specify the form and manner in which the 
information described in subparagraph (B)(ii) is made 
publicly available, including the following:
(i) Information that is required to be made 
available on the website of a covered entity 
that relates to any foundation model provided 
by the entity.
(ii) Information that is required to be 
displayed in a central location on a website 
hosted by the Commission, including, with 
respect to a foundation model, information that 
is substantially similar to the information 
required under clause (i).
(iii) Information submitted to the 
Commission that is not required to be publicly 
displayed, including sensitive or personally 
identifiable data or information, or 
information that would compromise the 
cybersecurity of the foundation model.
(iv) A requirement for a human-readable and 
consumer-friendly format to be used with 
respect to the information described in clause 
(i).
(v) A requirement for a machine-readable 
format to be used with respect to the 
information described under clause (ii).
(vi) The URL for the central location 
described in clause (ii).
(D) Provide an option for a covered entity to be 
deemed in compliance with some or all of this Act if 
the covered entity publishes the information determined 
to be necessary by the Commission pursuant to 
subsection (a)(1)(A) as part of a larger document, 
including a system card or model card.
(E) Specify a process for a covered entity to 
submit the information required under subparagraph 
(B)(i) to the Commission.
(2) Issue guidance to assist covered entities to comply 
with the standards established under paragraph (1).
(b) Information To Include.--The Commission shall include in the 
regulations promulgated pursuant to subsection (a)(1)(A), with respect 
to a foundation model, the following information:
(1) A sufficiently detailed summary of the sources of 
training data, how training data is collected, and whether and 
how data is collected and retained during inference.
(2) A broad description of the size and composition of such 
training data, including types of demographic information, 
language information, and other attribute information, while 
accounting for privacy.
(3) A description of data governance procedures.
(4) A description of the intended purposes and foreseen 
limitations or risks of the foundation model, an overview of 
past edits to such model, the version and date of release of 
such model, the knowledge cutoff date of the training data of 
such model, and information on adverse incident monitoring and 
response procedures.
(5) A list of or information about languages supported by 
the model.
(6) A description of the efforts of the covered entity to 
align the foundation model and the transparency of such model 
with--
(A) the AI Risk Management Framework (or any 
successor framework) of the National Institute of 
Standards and Technology;
(B) a similar Federal Government-approved consensus 
technical standard; or
(C) the model specification of any covered entity, 
including intended model behavior or outcomes and 
guardrails for the model.
(7) Performance under evaluation, either self-driven or 
through audit, on public or industry standard benchmarks, 
including what precautions the foundation model takes to answer 
or respond to situations with higher levels of risk of 
providing inaccurate or harmful information, including, if such 
model responds to such questions, relating to the following:
(A) Medical, health, or healthcare questions.
(B) Biological, chemical, radiological, or nuclear 
weapons.
(C) National security.
(D) Cybersecurity.
(E) Threats to critical infrastructure.
(F) Elections.
(G) Law enforcement.
(H) Financial loan or housing decisions.
(I) Education.
(J) Employment or hiring decisions.
(K) Public services.
(L) Information relating to vulnerable populations, 
including minors and seniors.
(8) Information on the computational power used to train 
and operate a foundation model.
(c) Exemptions for Specific Types of Foundation Models.--A fully 
open-source model is exempt from the regulations promulgated by the 
Commission pursuant to subsection (a).
(d) Consideration of Alternative Provisions for Downstream 
Foundation Models.--In promulgating the regulations and issuing the 
guidance required by subsection (a), the Commission shall require that 
a covered entity foundation model that is derived from or built upon 
another covered entity foundation model, including through the use of 
an application programming interface--
(1) shall publicly provide a URL to the transparency 
disclosure website of the base foundation model if the base 
model is in compliance with the regulations promulgated in 
subsection (a); and
(2) shall comply with regulations promulgated in subsection 
(a) related to any significant change, retraining, or 
adaptation from such base foundation model.
(e) Alternative Provisions for Certain Covered Entities.--The 
Commission shall establish a plan to assist small businesses and new 
businesses that are covered entities with compliance with the 
regulations promulgated pursuant to subsection (a) and to reduce the 
burdens imposed by such regulations, including by:
(1) Publishing guidance for compliance, including sample 
guidance and a machine-readable template, to be jointly 
developed by the Commission and the Director of the National 
Institute for Standards and Technology, for such covered 
entities to use that will facilitate compliance with such 
regulations.
(2) Providing one three-month grace period beginning on the 
date on which a small business or new business becomes a 
covered entity during which such covered entity is not subject 
to penalties under this Act or any regulation promulgated 
pursuant to this Act.
(3) Providing a qualified, technically proficient 
representative to meet on multiple occasions during such grace 
period with such covered entity to provide guidance to assist 
the covered entity with compliance with the regulations 
promulgated pursuant to subsection (a).
(f) Foundation Model Resources Page Required.--Not later than 1 
year after the date of the enactment of this Act, the Commission shall 
establish a web page on the website of the Commission that includes 
recommendations on foundation model transparency for foundation model 
developers or downstream deployers of a foundation model that are not 
covered entities, including recommended resources such as the AI Risk 
Management Framework of the National Institute of Standards and 
Technology.
(g) Permitted Redactions.--
(1) In general.--If a covered entity publishes documents or 
submits information to the Commission to comply with this Act, 
the covered entity may make redactions to those documents that 
are necessary--
(A) to protect the cybersecurity and security of 
the covered entity or model, public safety, or the 
national security of the United States; or
(B) to comply with any Federal law.
(2) Identification of redactions.--Any redaction shall be 
briefly identified and justified in the publication or 
submission.
(h) Applicability of Regulations.--The regulations required by 
subsection (a)(1) shall apply beginning on the date that is 90 days 
after the date on which the Commission promulgates such regulations.
(i) Updates.--Not later than 1 year after the date on which the 
Commission promulgates the regulations required by subsection (a)(1), 
and annually thereafter, the Commission, in consultation with the 
Director of the National Institute of Standards and Technology and the 
Secretary of Commerce, shall assess the requirements established by the 
regulations and update the regulations to incorporate any necessary 
update to such requirements.
(j) Enforcement by Federal Trade Commission.--
(1) Unfair or deceptive acts or practices.--A violation of 
a regulation promulgated under subsection (a)(1) shall be 
treated as a violation of a regulation under section 
18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or practices.
(2) Powers of commission.--Except as provided in subsection 
(l)(3)(C)--
(A) the Commission shall enforce the regulations 
promulgated under subsection (a)(1) in the same manner, 
by the same means, and with the same jurisdiction, 
powers, and duties as though all applicable terms and 
provisions of the Federal Trade Commission Act (15 
U.S.C. 41 et seq.) were incorporated into and made a 
part of this section;
(B) any covered entity that violates a regulation 
promulgated under subsection (a)(1) shall be subject to 
the penalties and entitled to the privileges and 
immunities provided in the Federal Trade Commission 
Act; and
(C) the Commission shall provide covered entities 
with notice that they are covered entities not less 
than fourteen days before taking any enforcement 
action.
(k) Report.--Not later than 1 year after the date of the enactment 
of this Act, the Commission shall submit to the Committee on Energy and 
Commerce and the Committee on Science, Space, and Technology of the 
House of Representatives and the Committee on Commerce, Science, and 
Transportation of the Senate a report on the establishment, 
implementation, and enforcement of the regulations issued pursuant to 
subsection (a)(1).
(l) Definitions.--In this section:
(1) Artificial intelligence.--The term ``artificial 
intelligence'' has the meaning given that term in section 5002 
of the National Artificial Intelligence Initiative Act of 2020 
(15 U.S.C. 9401; Public Law 116-283).
(2) Commission.--The term ``Commission'' means the Federal 
Trade Commission.
(3) Covered entity.--
(A) In general.--The term ``covered entity'' means 
any person, partnership, or corporation described in 
subparagraph (C) that provides use of or services from 
a foundation model which does any of the following:
(i) Exhibits, or could be easily modified 
to exhibit, high levels of performance at tasks 
that could pose a significant risk to security, 
national economic security, consumer 
protection, civil rights, national public 
health or safety, or any combination of those 
matters.
(ii) Has, in aggregate, over 10,000,000 
monthly users, including users of second party 
entities that use such model.
(iii) Has in aggregate, over 10,000,000 
monthly foundation model download instances if 
the model is typically downloaded once for use 
by a user.
(iv) Was trained using a quantity of 
computing power greater than 10\26\ integer or 
floating point operations, including computing 
used by the entity for the original training 
run and for any subsequent fine-tuning, 
reinforcement learning, or other material 
modifications the entity applies.
(B) Updating of thresholds.--The Commission, in 
consultation with the Director of the National 
Institute of Standards and Technology, the Secretary of 
Commerce, and the Director of the Office of Science and 
Technology Policy, may, by regulation promulgated in 
accordance with section 553 of title 5, United States 
Code, update the number of monthly output instances for 
purposes of subparagraph (A)(i), the number of monthly 
users for purposes of subparagraph (A)(ii), the number 
of monthly foundation model download instances for 
purposes of subparagraph (A)(iii), or the quantity of 
computing power for purposes of subparagraph (A)(iv) as 
the Commission considers appropriate.
(C) Persons, partnerships, and corporations 
described.--The persons, partnerships, and corporations 
described in this subparagraph are--
(i) any person, partnership, or corporation 
over which the Commission has jurisdiction 
under section 5(a)(2) of the Federal Trade 
Commission Act (15 U.S.C. 45(a)(2)); and
(ii) notwithstanding section 4, 5(a)(2), or 
6 of the Federal Trade Commission Act (15 
U.S.C. 44; 45(a)(2); 46) or any jurisdictional 
limitation of the Commission--
(I) any common carrier subject to 
the Communications Act of 1934 (47 
U.S.C. 151 et seq.) and all Acts 
amendatory thereof and supplementary 
thereto; and
(II) any organization not organized 
to carry on business for its own profit 
or that of its members.
(4) Critical infrastructure.--The term ``critical 
infrastructure'' has the meaning given that term in subsection 
(e) of the Critical Infrastructures Protection Act of 2001 (42 
U.S.C. 5195c(e)).
(5) Foundation model.--
(A) In general.--The term ``foundation model'' 
means an artificial intelligence model that meets the 
following requirements:
(i) Is trained on broad data.
(ii) Generally uses self-supervision.
(iii) Generally contains at least 
1,000,000,000 parameters.
(iv) Is designed for generality of output.
(v) Is generally applicable across a wide 
range of contexts, adaptable to a wide range of 
tasks, or can issue a wide range of outputs in 
response to inferences.
(B) Effect of technical safeguards.--The term 
``foundation model'' includes an artificial 
intelligence model otherwise described in subparagraph 
(A) even if such model is provided to users with 
technical safeguards that attempt to prevent users from 
taking advantage of any relevant capabilities that may 
be unsafe for consumer use.
(6) Inference.--The term ``inference'' means, with respect 
to a foundation model, when such foundation model is operated 
by a user to produce a result.
(7) Minor.--The term ``minor'' means any individual under 
the age of 18 years.
(8) New business.--The term ``new business'' means a 
startup or other new business that has been in operation for 
less than 1 year.
(9) Senior.--The term ``senior'' means an individual who is 
65 years of age or older.
(10) Small business.--The term ``small business'' has the 
meaning given the term ``small business concern'' in section 
3(a) of the Small Business Act (15 U.S.C. 632(a)).
(11) Training data.--The term ``training data'' means, with 
respect to a foundation model, the data on which such 
foundation model was trained.
<all>