Anthropic (draft circulated to lawmakers; no congressional sponsor) · 2026
Anthropic — Draft Frontier AI Bill (working titles: AEGIS Act; Advanced Artificial Intelligence Accountability Act of 2026)
Anthropic Draft Bill
First reported by Politico on October 16, 2026 and confirmed by Anthropic the next day, this is full legislative text, dated September 29, that a frontier developer has written and circulated to Congress. Its working titles are the Artificial Intelligence Evaluation, Governance, and Incident Safety (AEGIS) Act and the Advanced Artificial Intelligence Accountability Act of 2026. Its structure tracks the FRONTIER Act closely, with Commerce as the sole regulator. Every frontier developer (a foundation model trained above 10^25 operations, counting fine-tuning and RL) must publish a transparency report at each new deployment and report critical safety incidents within 15 days, or within 24 hours to Commerce and law enforcement if there is an imminent risk of death or serious injury. Large frontier developers, those with more than $500M in AI revenue or more than $1B in AI development spending, must also publish and follow a safety framework, certify compliance annually, publish risk reports every 180 days that cover internally used models substantially riskier than anything deployed, and maintain a security program audited against a Commerce-designated standard. They must also engage a registered independent evaluator every 180 days. The evaluator gets access comparable to the developer's own risk teams, publishes its findings, and must tell Commerce within 72 hours if it finds conditions that could produce catastrophic harm. Only a federal judge can stop a model. On application by the head of Commerce, the D.C. District Court may issue a 45-day blocking order suspending development, deployment, or internal use, but only if Commerce proves by a preponderance of the evidence that the model presents an imminent risk of more than 50 deaths or $1B in damage through one of four enumerated pathways: biological weapons, loss of control, offensive cyber operations, or automated AI research that amplifies those risks. Commerce must also show that no less restrictive measure would work. Preemption covers state disclosure, third-party evaluation, and incident-reporting obligations on any AI developer, and falls away if the federal requirements are struck down.
Key Provisions
Coverage: frontier models above 10^25 operations including fine-tuning and RL; large frontier developers above $500M in AI revenue or $1B in AI development spending, aggregated across affiliates
Large developers: published safety framework naming a responsible officer, annual compliance certification, material changes published within 30 days with a justification
Transparency report before or with each new general-access deployment; large developers add risk assessments, test methods and results, observed behaviors, and third-party involvement for models materially more capable or less safeguarded than before
Risk reports every 180 days covering externally deployed models and any internal model substantially riskier than those deployed, with enough evidence and reasoning that a reasonable person could reach a similar conclusion; unredacted copy to the board
Critical safety incidents (weight theft, catastrophic harm, loss of control causing injury, deceptive subversion of controls, containment failures) reported within 15 days; imminent risk to life within 24 hours to Commerce and law enforcement
Security program over weights and training and inference infrastructure, annual red-teaming and penetration testing including for distillation attacks, and an accredited independent audit against a Commerce-designated standard
Qualified independent evaluators registered and rated by Commerce, engaged every 180 days, paid by the developer only if payment is not tied to results; published reports, 72-hour referral of present or impending enumerated harm, and Commerce required to act or publish a no-action determination within 30 days
Blocking orders: only the D.C. District Court, on application by the head of Commerce without delegation, for 45 days at a time; preponderance standard, least-restrictive-means and narrow-tailoring findings, de novo review, an independent assessment required, no order resting on information the developer has not seen, and no order requiring deletion or disclosure of weights
Whistleblower protections for employees and contractors of developers and evaluators: no NDAs or arbitration waivers, an anonymous internal channel, double back pay, and jury trials
Civil penalties of the greater of $1M or an unspecified percentage of global revenue ($3M for repeat violations), imposed only by a federal court in suits brought by Commerce alone
Rulemaking limited to thresholds, forms, the security standard, and accreditation bodies; definitions changeable only by Congress
Preemption of state obligations on any AI developer covering risk disclosure, third-party evaluation, and incident reporting; state tort law, child safety, deployment and use rules, whistleblower supplements, and procurement preserved; no safe harbor; narrow construction; preemption void if the federal requirements fall
Regulatory Philosophy
Verification by default, intervention by a court. The draft accepts almost everything the safety community has asked for on information — frameworks, recurring risk reports, independent evaluators with real access and a public voice, incident reporting, security audits, whistleblower protection — and then fences the power to act on that information as tightly as any proposal on this map. Evaluators can only advise. Commerce can only ask. The decision to stop a model belongs to a federal judge applying a statutory test, with the burden on the government at every stage and each order lasting 45 days. The design reads as the view of a developer that wants to be checked and does not want to be stopped by anyone who has not proved the case.
Frontier developers above 10^25 operations; large frontier developers above $500M in AI revenue or $1B in AI development spending
Why it lands there
Every obligation falls on model developers. Revenue and spending are aggregated across affiliates, so labs inside hyperscaler parents are measured at parent scale but regulated as developers, not cloud operators. Deployers are expressly outside the preemption definition. The one place the bill reaches beyond the frontier layer is preemption itself, which protects every AI developer from state disclosure, evaluation, and incident-reporting rules.
Anthropic's draft borrows the FRONTIER Act's architecture — tiered developers, independent evaluators on a recurring cycle, mandatory referral of imminent risks, catastrophic risk set at 50 deaths or $1B, an exclusive federal mechanism for stopping a model, and preemption of three named subject areas — and changes who decides and how. Coverage is broader: 10^25 operations rather than 10^26, and a single large-developer tier reached by revenue or spending. Oversight is lighter: evaluators are registered and rated rather than licensed, and their findings bind no one. The emergency power moves from the Commerce Secretary to a federal judge, who may act only on a preponderance of the evidence, for 45 days at a time, after finding that nothing less restrictive would work. A state suspension power is defined as a fourth preempted function but, as drafted, the preemption clause reaches only the first three. The Institute for Law & AI's Charlie Bullock called the draft reasonable and more than other labs have offered, but weaker than the FRONTIER Act.
+Complete, operative statutory text, the most detailed proposal any frontier developer has put before Congress
+Its coverage threshold of 10^25 operations is lower than the FRONTIER Act's 10^26, and large-developer status turns on revenue or spending rather than both
+Independent evaluators get access comparable to the developer's internal risk teams, may publish over the developer's objection, and must state whether redactions affected their conclusions
+Risk reports must reach internally used models that are riskier than anything deployed, and must be reasoned enough for an outsider to check the conclusion
+Strong whistleblower provisions — no arbitration, an anonymous channel, double back pay, and jury trials — extend to the evaluators' own staff
+Preemption is drawn to fall away automatically if the federal requirements are struck down, and preserves state tort law, child safety, and deployment rules with an explicit rule of narrow construction
Weaknesses
From the perspective of political opposition
−Written by a company it would regulate, and every procedural safeguard on blocking orders protects the developer: head-of-agency signoff, an independent assessment, least-restrictive-means findings, de novo review, 45-day automatic expiry, and a bar on orders based on information the developer has not seen
−The enumerated risks that can justify a blocking order are narrower than those in its own catastrophic-risk definition: biological but not chemical, radiological, or nuclear weapons, and no autonomous crime short of offensive cyber operations
−Lawful activity of the federal government is excluded from both risk definitions
−Preemption reaches every AI developer, not only those the Act covers, so a state could not require disclosure or evaluation from a developer below the federal thresholds that the federal law also leaves untouched
−Only Commerce can enforce, only in court, and the revenue-based penalty percentage is left blank
−Evaluators are paid by the developers they assess and immune from most liability, and nothing in the draft funds an independent alternative unless Congress appropriates it