HR 9333
AI Flaw Reporting and Security Enhancement Act
Informational. No immediate compliance impact.
TL;DR
Rep. Deborah Ross (D-NC) introduced this bill to create a coordinated system for reporting security flaws and vulnerabilities in AI systems, similar to how cybersecurity bugs get reported today. It would direct NIST to establish standardized processes for researchers and companies to disclose AI vulnerabilities responsibly.
How This Might Impact Your Business
AI developers and vendors would gain a formal channel to receive and address flaw reports, similar to existing cybersecurity vulnerability disclosure programs
Companies deploying AI systems (think enterprises using LLMs, computer vision, or decision-making algorithms) should expect new standards from NIST for handling reported flaws
Security researchers and red-teamers would get clearer legal protections when probing AI systems for vulnerabilities, reducing legal risk for good-faith testing
No immediate penalties or mandatory compliance requirements in the current text; this builds infrastructure rather than imposing fines
Sectors with safety-critical AI (healthcare diagnostics, autonomous vehicles, financial fraud detection) will likely face the strongest pressure to adopt resulting NIST standards
Timeline is early: bill sits in House Science Committee with no hearing scheduled, so any standards are 18+ months away even if it passes
Government contractors using AI should watch closely, as federal procurement often adopts NIST frameworks as de facto requirements
What Should You Do
Ask your security team whether your company has a vulnerability disclosure policy that explicitly covers AI systems (most do not)
If you build or deploy AI, designate an internal owner for AI flaw reports now, before standards force a rushed assignment
Federal contractors should flag this to compliance teams, since NIST frameworks frequently become procurement requirements
Monitor the House Committee on Science, Space, and Technology for hearings or markup activity on HR 9333
Review your bug bounty program scope and confirm whether AI model flaws (prompt injection, jailbreaks, training data leaks) are eligible
Who It Affects
Sponsors
Status Timeline
committee
Referred to the House Committee on Science, Space, and Technology.
June 18, 2026
AI-generated analysis for informational purposes only. Not legal advice. Always consult a qualified attorney for legal guidance.
Need help preparing your team for AI compliance?
Talk to LaunchReady about AI Training