Anthropic (draft circulated to lawmakers; no congressional sponsor) · 2026
Anthropic — Draft Frontier AI Bill (working titles: AEGIS Act; Advanced Artificial Intelligence Accountability Act of 2026)
Anthropic Draft Bill
First reported by Politico on October 16, 2026 and confirmed by Anthropic the next day, this is full legislative text, dated September 29, that a frontier developer has written and circulated to Congress. Its working titles are the Artificial Intelligence Evaluation, Governance, and Incident Safety (AEGIS) Act and the Advanced Artificial Intelligence Accountability Act of 2026. Its structure tracks the FRONTIER Act closely, with Commerce as the sole regulator. Every frontier developer (a foundation model trained above 10^25 operations, counting fine-tuning and RL) must publish a transparency report at each new deployment and report critical safety incidents within 15 days, or within 24 hours to Commerce and law enforcement if there is an imminent risk of death or serious injury. Large frontier developers, those with more than $500M in AI revenue or more than $1B in AI development spending, must also publish and follow a safety framework, certify compliance annually, publish risk reports every 180 days that cover internally used models substantially riskier than anything deployed, and maintain a security program audited against a Commerce-designated standard. They must also engage a registered independent evaluator every 180 days. The evaluator gets access comparable to the developer's own risk teams, publishes its findings, and must tell Commerce within 72 hours if it finds conditions that could produce catastrophic harm. Only a federal judge can stop a model. On application by the head of Commerce, the D.C. District Court may issue a 45-day blocking order suspending development, deployment, or internal use, but only if Commerce proves by a preponderance of the evidence that the model presents an imminent risk of more than 50 deaths or $1B in damage through one of four enumerated pathways: biological weapons, loss of control, offensive cyber operations, or automated AI research that amplifies those risks. Commerce must also show that no less restrictive measure would work. Preemption covers state disclosure, third-party evaluation, and incident-reporting obligations on any AI developer, and falls away if the federal requirements are struck down. On October 18, Anthony Cimino, who leads Anthropic's federal affairs team, described the text as a translation of the company's Advanced AI Framework into bill form, shared with a small number of congressional offices, and said it was intended to be the strongest proposal on the table. He said Anthropic would revise the preemption language so that states keep a role in standards for independent evaluators and in regulating a lab's capacity to shut down a model; defended the blocking-order standard as guarding a substantial power against abuse, while noting that it leaves other national-security authorities and export controls in place; said the thresholds were worth re-evaluating; and said the company was developing stricter incident-reporting requirements, evaluator standards, safeguards against 'evaluator shopping,' and policies for adjusting the industry-wide pace of frontier development.
Key Provisions
Coverage: frontier models above 10^25 operations including fine-tuning and RL; large frontier developers above $500M in AI revenue or $1B in AI development spending, aggregated across affiliates
Large developers: published safety framework naming a responsible officer, annual compliance certification, material changes published within 30 days with a justification
Transparency report before or with each new general-access deployment; large developers add risk assessments, test methods and results, observed behaviors, and third-party involvement for models materially more capable or less safeguarded than before
Risk reports every 180 days covering externally deployed models and any internal model substantially riskier than those deployed, with enough evidence and reasoning that a reasonable person could reach a similar conclusion; unredacted copy to the board
Critical safety incidents (weight theft, catastrophic harm, loss of control causing injury, deceptive subversion of controls, containment failures) reported within 15 days; imminent risk to life within 24 hours to Commerce and law enforcement
Security program over weights and training and inference infrastructure, annual red-teaming and penetration testing including for distillation attacks, and an accredited independent audit against a Commerce-designated standard
Qualified independent evaluators registered and rated by Commerce, engaged every 180 days, paid by the developer only if payment is not tied to results; published reports, 72-hour referral of present or impending enumerated harm, and Commerce required to act or publish a no-action determination within 30 days
Blocking orders: only the D.C. District Court, on application by the head of Commerce without delegation, for 45 days at a time; preponderance standard, least-restrictive-means and narrow-tailoring findings, de novo review, an independent assessment required, no order resting on information the developer has not seen, and no order requiring deletion or disclosure of weights; in judging whether a less restrictive measure would work, the court must weigh the harm an order would cause to the developer, users, and the public
Whistleblower protections for employees and contractors of developers and evaluators: no NDAs or arbitration waivers, an anonymous internal channel, double back pay, and jury trials
Civil penalties of the greater of $1M or an unspecified percentage of global revenue ($3M for repeat violations), imposed only by a federal court in suits brought by Commerce alone
Rulemaking limited to adjusting the numerical coverage thresholds (in either direction, at most once every 24 months unless the change expands coverage), forms, the security standard, and accreditation bodies; definitions otherwise changeable only by Congress
Preemption of state obligations on any AI developer covering risk disclosure, third-party evaluation, and incident reporting; state tort law, child safety, deployment and use rules, whistleblower supplements, and procurement preserved; no safe harbor; narrow construction; preemption void if the federal requirements fall
Regulatory Philosophy
Verification by default, intervention by a court. The draft accepts almost everything the safety community has asked for on information — frameworks, recurring risk reports, independent evaluators with real access and a public voice, incident reporting, security audits, whistleblower protection — and then fences the power to act on that information as tightly as any proposal on this map. Evaluators can only advise. Commerce can only ask. The decision to stop a model belongs to a federal judge applying a statutory test, with the burden on the government at every stage and each order lasting 45 days. The design reads as the view of a developer that wants to be checked and does not want to be stopped by anyone who has not proved the case.
Frontier developers above 10^25 operations; large frontier developers above $500M in AI revenue or $1B in AI development spending
Why it lands there
Every obligation falls on model developers. Revenue and spending are aggregated across affiliates, so labs inside hyperscaler parents are measured at parent scale but regulated as developers, not cloud operators. Deployers are expressly outside the preemption definition. The one place the bill reaches beyond the frontier layer is preemption itself, which protects every AI developer from state disclosure, evaluation, and incident-reporting rules.
Anthropic's draft borrows the FRONTIER Act's architecture — tiered developers, independent evaluators on a recurring cycle, mandatory referral of imminent risks, catastrophic risk set at 50 deaths or $1B, an exclusive federal mechanism for stopping a model, and preemption of three named subject areas — and changes who decides and how. Coverage is broader: 10^25 operations rather than 10^26, and a single large-developer tier reached by revenue or spending. Oversight is lighter: evaluators are registered and rated rather than licensed, and their findings bind no one. The emergency power moves from the Commerce Secretary to a federal judge, who may act only on a preponderance of the evidence, for 45 days at a time, after finding that nothing less restrictive would work. The FRONTIER Act's requirement that verifiers judge whether mitigation is adequate, and its corrective-action cycle, are gone. The draft also defines state suspension of a model, including by judicial decree, as a fourth preempted function, effective once the blocking-order section is enacted; it is meant to leave the power to stop a model with the federal government alone, and only a drafting error, a preemption clause that cites the first three functions, keeps it from doing so. Reaction from safety advocates ranged from qualified to sharply critical. The Institute for Law & AI's Charlie Bullock called it reasonable and more than other labs have offered, but weaker than the FRONTIER Act; Nathan Calvin argued that passing it would leave the public less protected against catastrophic risk than current law; and Alex Bores, author of New York's RAISE Act, noted that Anthropic's own June framework conditioned preemption on a federal regime that meets or exceeds its strongest measures, which on blocking authority and evaluator independence the draft does not. Anthropic's federal affairs lead answered that the draft is meant to be the strongest proposal on the table and that its preemption language would be narrowed. Measured against the FRONTIER Act, it is stronger on coverage, evaluator access, and whistleblower protection, and weaker on rulemaking, emergency authority, penalties, and the adequacy standard.
+Complete, operative statutory text, the most detailed proposal any frontier developer has put before Congress
+Its coverage threshold of 10^25 operations is lower than the FRONTIER Act's 10^26, and large-developer status turns on revenue or spending rather than both, though developers below the large tier owe only transparency and incident reports
+Commerce can lower the coverage thresholds as well as raise them, and changes that expand coverage are exempt from the once-every-24-months limit; the FRONTIER Act allows only increases
+Independent evaluators get access comparable to the developer's internal risk teams, may publish over the developer's objection, and must state whether redactions affected their conclusions
+Risk reports must reach internally used models that are riskier than anything deployed, and must be reasoned enough for an outsider to check the conclusion
+Strong whistleblower provisions — no arbitration, an anonymous channel, double back pay, and jury trials — extend to the evaluators' own staff
+Preemption is drawn to fall away automatically if the federal requirements are struck down, and preserves state tort law, child safety, and deployment rules with an explicit rule of narrow construction
Weaknesses
From the perspective of political opposition
−Written by a company it would regulate, and every procedural safeguard on blocking orders protects the developer: head-of-agency signoff, an independent assessment, least-restrictive-means findings, de novo review, 45-day automatic expiry, and a bar on orders based on information the developer has not seen
−10^25 operations is GPT-4-era compute, well below current frontier training runs, and because compute from a preceding foundation model counts toward the total, anyone who fine-tunes a large open-weight model arguably becomes a frontier developer, owing incident reports on a model it may be unable to monitor once released; Anthropic's own June framework covered only developers that also passed the revenue-or-spending test
−Falls short of the condition Anthropic's June framework set for preemption, a federal regime that 'meets or exceeds the strongest measures proposed': the framework let an agency bar further deployments for missing reports, an unqualified or under-resourced evaluator, or significant catastrophic risk after safeguards, and proposed licensing, pooled funding, and random assignment for evaluators; the draft keeps only a court order for imminent risk and developer-paid, unlicensed evaluators
−The test for a blocking order weighs only one side: the court must consider the harm an order would cause to the developer, users, and the public, with no matching instruction to weigh the harm of letting the model run
−Drops the FRONTIER Act's substantive standard and corrective-action cycle: no one must judge whether a developer's mitigation is adequate, and nothing requires a developer to fix what an evaluator finds
−The enumerated risks that can justify a blocking order are narrower than those in its own catastrophic-risk definition: biological but not chemical, radiological, or nuclear weapons, and no autonomous crime short of offensive cyber operations
−Lawful activity of the federal government is excluded from both risk definitions
−Preemption reaches every AI developer, not only those the Act covers, so a state could not require disclosure or evaluation from a developer below the federal thresholds that the federal law also leaves untouched
−Only Commerce can enforce, only in court, and the revenue-based penalty percentage is left blank
−Evaluators are paid by the developers they assess and immune from most liability, and nothing in the draft funds an independent alternative unless Congress appropriates it
On the Podcasts
Verbatim from podcast transcripts; each links to the moment it was said
“This reads as intentional, that Anthropic is more afraid that the government might enforce rules against Anthropic than they are worried about the ability of the government to enforce rules against everyone.”
Zvi Mowshowitz, Writer, Don't Worry About the VaseDon't Worry About the Vase Podcast · Leaked Anthropic Draft AI Regulatory Bill Is Unacceptable and Troubling · Oct 17, 2026
“Anthropic deserves some credit for actually proposing a pretty reasonable AI safety bill. That's more than other frontier labs have done. But they don't deserve too much credit, IMO. This bill is weaker than the Trahan-Obernolte Frontier Act in some key ways.”
Charlie Bullock, AI governance lawyer, Institute for Law & AI (written commentary, read on air)Don't Worry About the Vase Podcast · Leaked Anthropic Draft AI Regulatory Bill Is Unacceptable and Troubling · Oct 17, 2026
“The proposal also includes independent evaluators registered with the Commerce Department. Labs could pay them subject to safeguards of their independence. I have a problem with how easy it is to remain independent when you're being paid by the company you're assessing.”
Jim Love, Tech journalist, host of Hashtag TrendingHashtag Trending · Rogue AI Agents Answer Investigator's Emails: Hashtag Trending · Oct 19, 2026