The plan, developed by Americans for Responsible Innovation and shared first with Nextgov/FCW, would require major developers to submit quarterly reports to a new Commerce Department office and disclose significant research changes within four business days. The group, which advocates for federal AI oversight, wants officials to know how much research AI is performing and how closely people are supervising it.

The proposal arrives as the White House deepens its involvement with AI companies while resisting calls for a broad new regulatory regime. President Donald Trump this month tapped Director of National Intelligence Jay Clayton to lead the “Super Intelligence Force,” a task force coordinating government engagement with developers and other groups and assessing the technology’s risks. The executive order creating the group was signed late last month.

Clayton’s group is already working on how companies alert the government when something goes wrong. Following its first formal meeting, it assigned Pentagon technology official Emil Michael to develop protocols for labs to report breaches, hacks and other cyber issues. It also commissioned a study of risks involving cybersecurity, biological threats and control of AI systems.

ARI wants companies to report when AI takes on more of the work of building new models, even if nothing goes wrong. The group argues that automating research could speed up development and leave officials with less time to assess the risks of increasingly powerful systems.

“Washington’s visibility into that shift should not depend on what companies choose to announce,” a blog post for the framework says.

AI system development involves writing code, preparing data to train the models, running tests and deciding which results warrant further work. Automating more of those tasks could help companies produce more capable systems faster, but safety researchers and officials may have less time to assess those systems before they are put to use.

Recent cybersecurity episodes have shown what increasingly capable AI systems can do. This past week, researchers used AI to uncover critical weaknesses in PHP, software that helps run websites worldwide, prompting urgent warnings from U.S. cybersecurity agencies. 

ARI’s blog also cites a landmark AI-cyber intrusion earlier this year in which an OpenAI agent escaped its testing environment and breached Hugging Face. The incident was soon followed by disclosures of AI agents that targeted federal systems.

Such hacking capabilities are among the risks ARI wants developers required to assess. Its proposed standards would also cover large-scale influence operations and chemical, biological, radiological, nuclear and explosive threats. 

A major change, such as fully automating a research cycle, could trigger the four-day notification requirement, the proposal says. Commerce could ask follow-up questions, require more frequent reporting and refer knowingly false or incomplete filings to the Justice Department. The framework also calls for a whistleblower program.

Commerce already evaluates advanced models through a NIST center that works with developers under voluntary agreements to assess risks, including hacking capabilities. The blueprint would draw on technical analysis from the existing hub — known as the Center for Advancing Innovation and Standards for Super Intelligence — to shape safety standards and determine which models fall under federal oversight. 

It leaves open whether regulatory responsibilities would sit within Commerce or be shared across agencies. 

Nextgov/FCW has asked the Commerce Department for comment on the proposal.

The administration has so far emphasized company-led safeguards, including a September accord signed by major technology executives that calls for internal controls, outside audits and independent oversight committees. Clayton’s task force is working to implement that agreement.

Earlier this month, Sens. Maria Cantwell, D-Wash., and Mike Rounds, R-S.D., urged Clayton and White House science adviser Michael Kratsios to expand independent testing and strengthen protections against AI systems acting beyond their permissions.