Skip to main content
Commerce Security logo, "All 12 PCI DSS Requirements in Plain English," "Get it now for free," "Complete Survival Guide" and a button toclick to get it
Should You Draft Your Own AI Safety Bill?Compliance & Audit
4 min readFor AI Governance Leaders

Should You Draft Your Own AI Safety Bill?

You're building frontier AI systems, and your legal team is keeping an eye on federal legislation. You've seen Anthropic circulate a draft bill to congressional offices, and now you're wondering: should you do the same?

Here's a guide to help you decide if drafting legislative language aligns with your governance goals or if it might undermine them.

The Decision You're Facing

Your organization has a stance on AI safety regulation. You could:

  • Wait for Congress to draft legislation and respond during comment periods
  • Share a policy framework or principles document with policymakers
  • Draft legislative language and circulate it to congressional offices

Anthropic chose the third path, sharing a draft bill with a few congressional offices. This draft included specific preemption clauses, model blocking procedures, and risk thresholds.

The response was swift and critical. Critics labeled the draft as "nakedly self-interested" and accused Anthropic of regulatory capture. Anthony Cimino, the company's federal affairs lead, later admitted the draft "could be improved" on several fronts, including preemption and risk thresholds.

Key Factors That Affect Your Choice

Before deciding whether to draft legislative language, consider these factors:

Your regulatory position relative to the status quo. Are you advocating for stronger or weaker requirements than those currently in place? Anthropic's draft was presented as "the strongest bill on the table," yet it included risk thresholds from California law that many safety advocates find too high.

The preemption trade you're willing to make. Federal legislation often overrides state law. Consider what you're offering in return. Anthropic's draft suggested giving the Federal Government all power over catastrophic AI risks while requiring Commerce to petition a district court before blocking a dangerous model. This asks states to give up authority while limiting federal enforcement.

Your timeline assumptions. Anthropic circulated its draft in September 2024, during a transitional Congress. Timing is crucial. If you believe federal legislation is imminent, offering compromise language might make sense. If you think Congress will move slowly, anchoring on a weak federal standard while preempting states could appear as stalling.

Path A: Draft Legislative Language When...

Choose this path if you can affirmatively answer these:

You're advocating for stronger requirements than current proposals. If your draft mandates independent evaluator assessments, requires reporting of containment breaches, or establishes model blocking authority that doesn't exist today, you're contributing to the policy conversation.

You're prepared to accept federal preemption without weakening enforcement. Like the Atomic Energy Act, where federal standards preempt state law due to their comprehensiveness and strict enforcement, your draft should include clear enforcement mechanisms and meaningful penalties.

You have political capital and the timing is right. Circulating legislative language makes you a target. You need strong relationships with congressional offices and a legislative window where passage is plausible.

Anthropic's draft failed on at least two of these criteria. The risk thresholds were high, the court petition requirement for model blocking caused delays, and the timing coincided with political shifts.

Path B: Share Policy Frameworks When...

Choose this path if:

You want influence without becoming the anchor. A policy framework outlines principles and objectives without locking in specific language. Anthropic's Advanced AI Framework proposal, which came before the draft bill, described concepts like independent evaluators and incident reporting without specifying exact thresholds.

You're still developing positions on key questions. If you're uncertain about implementation details, a framework lets you establish principles while allowing room for refinement.

You need to coordinate with other stakeholders. A framework can accommodate multiple enforcement approaches, unlike a draft bill with strong preemption.

This path works when you're genuinely trying to strengthen regulation. The test is whether your framework would make taking action easier or harder.

Path C: Respond Through Official Channels When...

Choose this path if:

Your interests conflict with safety requirements. If you're arguing for higher risk thresholds or broader preemption than safety advocates support, drafting legislation may appear as regulatory capture. It's more honest to oppose specific bills through comment periods and testimony.

You lack the expertise to draft workable language. If you don't understand the domain well enough to match mechanisms to risk profiles, you shouldn't be drafting.

You're a smaller player without frontier capabilities. If you're not developing models that could trigger catastrophic risk thresholds, circulating a draft bill about frontier AI safety might seem presumptuous. Focus on areas where you have direct experience.

Summary Matrix

Factor Draft Bill Policy Framework Official Response
Regulatory stance Stronger than status quo Principles-based Opposing specific provisions
Preemption trade Strong federal standard Flexible enforcement Preserve state authority
Enforcement mechanism Specific procedures Outcome-focused Critique existing proposals
Timeline Imminent passage likely Ongoing dialogue React to introduced bills
Political capital High, with relationships Medium, broad engagement Low, public comments
Risk profile Frontier capabilities Emerging capabilities Non-frontier operations

The lesson from Anthropic's draft isn't that companies should avoid engaging with legislative language. It's that drafting a bill is a high-stakes move that only works when you're genuinely trying to make regulation stronger, not when you're optimizing for business interests while catastrophic risks remain unaddressed.

If you can't meet that standard, stick with frameworks or official comments. The dress rehearsal stage of AI policy is over.

a promotional banner asking how ready are you for PCI DSS 4.0? With a call-to-action to get the checklist now.

You Might Also Like