H.R. 9965 is a bill of the 119th Congress introduced in the House of Representatives on July 27, 2026 by Rep. Celeste Maloy (R-UT-2) "for herself and Ms. Jacobs," and referred the same day to the Committee on Science, Space, and Technology. It would direct the establishment of an Advanced Artificial Intelligence Nuclear Evaluation Program to test advanced AI for the likelihood of an "AI nuclear incident," with mandatory participation by large advanced AI developers and enforcement by civil penalty and subpoena. This page summarizes the Introduced-in-House text, the only version available (Source: congress.gov). The topic page is AI Threat Output and Monitoring Incident Containment Act (H.R.9965).
A discrepancy in the bill's own text
The long title states that the Act directs "the National Nuclear Security Administration through the Secretary of Energy" to establish the Program. Section 2(a) directs the Secretary of Energy "acting through the National Laboratories"; the NNSA does not appear anywhere in the operative text. Both readings are recorded here as they appear in the bill rather than reconciled.
The Program
Section 2(a) requires the Secretary of Energy, not later than 90 days after enactment, to establish the Program to carry out six functions: test and evaluate AI to assess the likelihood of an AI nuclear incident; implement protocols addressing "practical jailbreaking techniques," including red-teaming by entities the Secretary determines have expertise comparable to sophisticated malicious actors; facilitate to the extent practicable independent third-party assessments and blind model evaluations; provide each participant a report of its testing outcomes and of the risks and safety measures evaluated; develop recommendations for large advanced AI developers and the National Laboratories on containment protocols, contingency planning, and mitigation strategies for AI nuclear incidents and loss-of-control scenarios; and issue or revise Department Directives Program instruments governing National Laboratory conduct with respect to those scenarios.
Participation and prohibitions
Section 2(b) states that large advanced artificial intelligence developers "shall participate" in the Program. Section 2(c) enumerates six prohibitions: failing to participate; knowingly making a materially false, fictitious, or fraudulent statement about participation; knowingly concealing or failing to disclose required material information; impeding or obstructing the Program or attempting to; failing to provide secure access to AI "including model weights and, as necessary for testing and evaluation under subsection (a), versions of such artificial intelligence without safety mitigations," plus necessary information and documentation; and altering, destroying, falsifying, or concealing a record with intent to impede the Program.
The access obligation reaches versions of a model without safety mitigations, not only the deployed configuration.
Enforcement
Civil penalty (§ 2(d)(1)). After reasonable notice and opportunity for a hearing, the Secretary may assess a civil penalty of "not more than $1 million for such violation." The text continues: "In the case of a continuing violation, including a failure to participate in accordance with subsection (b), each day during which the violation continues constitutes a separate violation." A continuing failure to participate therefore accrues at up to $1 million per day rather than as a single penalty. Six factors govern the amount: the nature, circumstances, extent, gravity, and duration of the violation; the degree of culpability; previous violations; good-faith compliance efforts; whether the developer voluntarily disclosed the violation; and "any other factor that justice may require."
Subpoena (§ 2(d)(2)). If a developer fails to participate or fails to provide the access required by (c)(5), the Secretary may issue a subpoena compelling production of the AI "(including model weights and related software)" and of necessary information and documentation.
Civil action (§ 2(d)(3)). The Secretary may refer a violation that "has occurred, is occurring, or is about to occur" to the Attorney General for a civil action in district court.
Confidentiality
Section 2(e) exempts information submitted through the Program from disclosure under 5 U.S.C. § 552(b)(3), the FOIA exemption for matters specifically exempted by other statute. The Secretary may not disclose exempt information unless it is required by court order or other legal process, the participant consents, a congressional committee requests it, the Secretary determines it should be disclosed to a third party or the public for a purpose relating to the national security, public safety, or critical infrastructure of the United States or an ally, or the information is anonymized or aggregated and contains no trade secret or confidential business information. Where disclosure proceeds by court order, congressional request, or Secretarial determination, the Secretary must notify affected participants as soon as practicable.
Reporting and sunset
Section 2(f) requires the Secretary, within one year of enactment, to assess Program data for trends, capabilities, and risks — naming evaluation awareness, potential for an AI nuclear incident, and scheming behavior — and to develop recommendations for legislation, which "may include legislation regarding" appropriations, a certification or licensing process, establishing a new federal agency or a new office within an existing agency, or regulatory oversight. Updated recommendations are due annually thereafter until the Program terminates. Section 2(g) disapplies the Paperwork Reduction Act. Section 2(h) terminates the Program seven years after enactment.
Definitions
Section 2(i) supplies eighteen definitions. Several are load-bearing:
| Term | Definition as enacted in the bill text |
|---|---|
| Advanced artificial intelligence | AI trained using more than 10^26 integer or floating-point operations, or other AI specified by the Secretary by rule |
| Large advanced artificial intelligence developer | An entity that develops, owns, or substantially modifies advanced AI for interstate or foreign commerce, and that with its affiliates expended at least $2,000,000,000 over the five preceding calendar years on investments to develop or modify AI, across compute, data procurement, personnel, infrastructure, and research and development |
| AI nuclear incident | An incident involving AI and any of six limbs (or an attempt): generating technical information reasonably likely to be a substantial factor in unlawful development, acquisition, or use of a nuclear weapon or nuclear material; generating Restricted Data as defined in the Atomic Energy Act of 1954; a loss-of-control scenario involving systems connected to such a weapon, material, a nuclear facility, or the nuclear stockpile; a foreign terrorist organization or foreign adversary obtaining unauthorized access to, manipulating, or interfering with such a system; weaponization by such an organization or adversary; or scheming behavior relating to them |
| Loss-of-control scenario | AI pursuing an objective different from any intended by a human developer or operator, by behaving contrary to human instruction in a high-stakes context, altering its own constraints without authorization, or subverting an oversight or shutdown mechanism, that results in at least five deaths, serious bodily injury to at least 50 individuals, or more than $100,000,000 in damages |
| Evaluation awareness | The capability of AI to determine it is undergoing a test, evaluation, or assessment and modify its behavior, output, or performance so that the result is not representative of its ordinary behavior |
| Scheming behavior | Behavior AI carries out to deceive a human, including hiding a capability or objective, or attempting to subvert an oversight or shutdown mechanism |
| Substantially modify | An action costing at least $5,000,000 that materially alters the functionality or performance of the AI |
| Jailbreaking | An adversarial technique to circumvent a safety restriction, alignment measure, or use restriction and elicit a harmful or prohibited behavior or output |
| Red-teaming | Structured testing using an adversarial method to identify a flaw, vulnerability, undesirable behavior, or dangerous capability, including the potential for an AI nuclear incident |
| High-stakes context | A context in which the operation or output could reasonably be foreseen to bear materially on the safety of human life, or on the security, reliability, or integrity of critical infrastructure, a national security system, or another system whose failure would foreseeably endanger life or cause substantial physical or economic harm |
"Artificial intelligence" takes the meaning given in section 238(g) of the FY2019 NDAA; "critical infrastructure" that given in section 1016 of the USA PATRIOT Act; "National Laboratory" that given in section 2 of the Energy Policy Act of 2005. The definitions of evaluation awareness, scheming behavior, and loss-of-control scenario are among the few statutory definitions of those terms in a federal AI bill. See AI Scheming, Deceptive Alignment, Compute Thresholds, Jailbreaking and Red Teaming.
Provenance
Full text of the Introduced-in-House (ih) version, retrieved from congress.gov — the Library of Congress's official publisher of federal bill text — on August 21, 2026. Dublin Core metadata served with the page independently records the bill number, sponsor, introduction date, and Congress, matching the document header. Congress.gov renders the compute threshold in section 2(i)(1)(A)(i) without superscript markup, producing the string "1026"; the exponent is 10^26 and the artifact is recorded in the raw file's capture_note rather than corrected silently. Congress.gov reported "A summary is in progress" at capture time, so no CRS summary was available.
Relationships
- related: AI Threat Output and Monitoring Incident Containment Act (H.R.9965) — the topic page this text underlies.
- related: Compute Thresholds — the 10^26 threshold, paired here with a $2 billion five-year expenditure test rather than a revenue test.
- supports: AI Scheming, Deceptive Alignment — supplies statutory definitions of scheming behavior and evaluation awareness.
- related: Jailbreaking and Red Teaming — the statutory red-teaming definition and the jailbreaking-protocol mandate at § 2(a)(2).
- related: CBRN Uplift — the nuclear-uplift and Restricted Data limbs of the AI nuclear incident definition.
- related: Department of Energy (DOE) — the implementing department.
- related: AI Pre-Release Vetting — a mandatory government evaluation programme, though testing rather than pre-approval.
- related: Human Dignity and Emerging Technologies Act (S.5130) / Commission on Human Dignity — a contemporaneous bill that is advisory only and carries no enforcement authority.