MODEL ACT — Frontier AI Public Welfare Offenses

COMPANION · v3.4 · August 2026 · public domain

The Act itself — SEC. 0 through SEC. 13, the research-draft text — is model_act_v3_4.txt. This document carries everything a bill jacket does not: the open items, the answers to friendly proposals, the drafting notes, and the reason the document exists. The audit trail behind every change is in /audit.

Open issues — QUESTIONS FOR THE NEXT REVISION (v3.5)

The next revision is v3.5, in preparation. This section is the authoritative status index for the project’s open, partly closed, state-specific, and closed questions. The numbered briefs below preserve completed work as well as work still needed, so a reader can see what changed without reopening a settled question.

Item	Status	Missing reader or decision
1. Standards inventory currency	State-specific	A standards-literate technologist must re-pin versions at adoption.
2. State classification tables	State-specific	Legislative counsel in the adopting state must conform classifications and brackets.
3. Harm-tier questions	Partly closed	The injury source is answered and drafted for v3.5. The death-results minimum and the report-versus-element distinction remain open for a criminal-law scholar or former prosecutor.
4. Outbreak-scale proportionality	Open	A proportionality scholar should test the drafted sentencing valve against state constitutional clauses.
5. Preemption and federalism	Open and monitored	A federalism litigator, ideally in a state attorney general’s office, should test the existing architecture as the litigation develops.
6. Modifiability-evaluation budget	Open	An evaluations researcher should assess the percentage-and-absolute compute floor.
7. Penalty-dollar calibration	Closed at v3.3	No missing reader; any remaining sentencing question belongs to item 4.
8. Laboratory control objectives	Open	A security engineer with experience inside a frontier laboratory should test them against practice.
9. State conforming amendments	State-specific	Legislative counsel in the adopting state must settle placement, classifications, the pin date, and the state self-incrimination pass.
10. Litigation-grade citation check	Open	A law-review editor or other Bluebook-literate reader should complete the consolidated check.
11. Objective incident triggers	Open	The two characterization-shaped triggers require objective, rule-thresholded drafting coordinated with the regulations.

An answer to an open item may become splice-ready language in the v3.5 cure queue before the revision is tagged. State-specific items are instructions for an adopting jurisdiction rather than unfinished universal text. Closed items remain visible so that the movement is checkable.

This Act is finished enough to introduce and honest enough to identify the judgments it still needs. If one numbered question is yours, that question is the whole ask.

WHY THIS DOCUMENT EXISTS

In 1937 a licensed American company shipped a medicine dissolved in antifreeze. More than a hundred people died, many of them children. The company’s owner said: “I do not feel that there was any responsibility on our part.” In 1938 Congress passed the Food, Drug, and Cosmetic Act. In 1943 the Supreme Court held a company president criminally liable for what shipped, knowledge irrelevant (Dotterweich). Six years from “no responsibility” to the law inventing the responsibility for him.

That is the allocation this Act extends. It does not ask first whether an officer knew the exact harm a system would cause. It asks who held practical power over the relevant risk and whether that person exercised due care. Knowledge and willfulness grade the offense; they do not create the duty. The entity remains separately liable, but its fine cannot discharge, insure, indemnify, reimburse, or otherwise absorb the natural person’s consequence. SEC. 4 finds the power; SEC. 6 attaches the individual offense; SEC. 7 and SEC. 10 keep it personal.

Legislation follows this sequence: incident, hearing, record, bill. The Pecora hearings of 1933–34 worked because the securities acts were being drafted while the bankers testified; every admission slotted into a bill section the same week. The bills that ride a post-hearing wave are the ones drafted beforehand, because the window after a hearing is weeks and drafting well takes months. Legislators who move fast reach for whatever finished text is lying around.

This is finished text, lying around.

Read what it does and does not do. It never touches the person running a model on their own machine; personal use is not deployment, and nothing in it restricts anyone’s use, study, or modification of lawfully obtained weights. It is neutral between open and closed distribution: releasing frontier weights carries the same validation duty as deploying them behind an API — parity, not penalty. Its whistleblower section voids the gag clauses and pays any person whose information leads to enforcement, from the violators’ own penalties. Where a violation kills, it orders restitution to each person harmed, and its records — never privileged as to facts — build the evidence file for the people who sue. Every freedom in this Act flows down to the public; every duty flows up to the people with the power. It regulates power over frontier systems, not the public’s access to them.

One state is enough to begin. The Illinois Biometric Information Privacy Act of 2008 passed with almost no attention and became the most consequential privacy statute in America. State law is where this doctrine has always lived best; no federal permission is required — and the Act’s spine is chosen for weather: state criminal law governing conduct that harms people in-state is the oldest police power there is, the piece that preemption reaches last. If any provision falls, the remainder stands, and the criminal core is the remainder built to stand — since v3.3 that is operative text, not rhetoric: SEC. 13 names the core and the order of severance.

On anonymity: public-domain legal drafting has a long pseudonymous tradition. The Federalist Papers were signed “Publius.” This document is not lobbying. It is a tool left on the table, handle facing outward.

The premise underneath all of it is the oldest one: governments derive their just powers from the consent of the governed. Nobody was asked whether systems that can breach, deceive, and self-replicate should be built and aimed at the public. Consent was not sought; it cannot be presumed. A statute is how consent is put in writing.

FRIENDLY PROPOSALS, ANSWERED

Two proposals arrive weekly from people who want this Act to succeed, and each deserves conversion rather than correction, because each is the Act’s own instinct arriving in cruder form.

The kill switch — and it is no longer only a proposal. On 23 July 2026 Representatives Ted Lieu and Nathaniel Moran introduced H.R. 9917, the AI Kill Switch Act: covered entities would have to maintain the technical ability to throttle, suspend or fully shut down a covered system, the Secretary of Homeland Security could order a slowdown or shutdown, and civil penalties run to two million dollars a day, rising to twenty million a day for breach of an emergency order.

Read for the one question this project asks, the bill answers it the same way the informal proposal does. The word officer does not appear in it. Nor director, nor natural person, nor certify, nor any criminal provision at all. The only human signature the AI Kill Switch Act requires is the sponsor’s own, on the line marked “(Original Signature of Member)”. The two instruments are therefore not rivals and the Act takes no position on the bill’s merits: the federal bill requires the brake to exist; this Act names who must use it. The full row, with the word test and its verification limits, is at the bill census.

The proposal in its original form, and the answer it has always been given:

Mandate an off-switch, the proposal runs: a named human empowered to shut the system down, personally responsible for activations. The instinct is exactly right — someone with the power to halt should answer personally — and the Act declines only the implementation: this Act does not regulate the button; it regulates the hand. A mandated switch is a design mandate — the vetoed SB 1047 move — technically contested on its merits and exposed to every preemption clause aimed at laws “specifically regulating the development” of models. Attaching due-care criminal liability to whoever holds practical power to halt (SEC. 4; SEC. 6) reaches the same person the switch mandate wants, and is feasibility-proof: no one has to agree on where the button goes, only on who could have pressed whatever exists. If there is a switch, the person who could have used it is liable for not using it. If there is no switch, the person who could have built one is liable for that. The switch mandate regulates one control; SEC. 4 regulates every hand on every control, including the hands that decided how many controls to build.

The corporate form. Incorporate as a DAO, the other proposal runs — tokenholders, multisig signers, no CEO to indict — sometimes offered as a fear, sometimes as a plan. A decentralized-governance vehicle is the next liability-evaporation structure in a lineage the Act was drafted against: parent-entity folds, supervoting parents, controlling foundations, designated safety officers, and now formal control diffused across tokenholders and signers until no natural person “controls” anything. SEC. 4(a) was already waiting: authority “held or exercised directly or indirectly, individually or in concert with others, and through any intermediary, entity, trust, or arrangement,” including “ownership, voting, contractual, governance, or other rights” conferring practical power to prevent, halt, restrict, or correct. Diffusion of formal control is a renaming of practical control, not an absence of it; the multisig signer holds a key, and a key is practical power (n.4).

Both proposals are made by allies who have not yet read SEC. 4. This section exists so they don’t have to be told twice.

PLACEMENT (FOR ADOPTING STATES)

SEC. 0 should be enacted as an uncodified findings section — in the bill, outside the code: findings do characterization work without creating duties, and an uncodified section is not readily the “law or regulation” a preemption clause operates on. SEC. 13 must be codified, because its clauses operate. Either style SEC. 0 as “SECTION 1. FINDINGS AND PURPOSE (uncodified)” with a global renumber, or keep the SEC. 0 style and let each state’s legislative counsel conform. Do not renumber SEC. 1–12 in this repository without conforming every cross-reference in the drafting notes and the regulations draft.

Codify SEC. 4, SEC. 5, SEC. 6, SEC. 7 and SEC. 10 in the state’s penal code, among the offenses against the person and against public safety, and not in a new artificial-intelligence title. The penalties must travel with the offenses. Codify SEC. 1, SEC. 2, SEC. 12 and SEC. 13 with them, so that the definitions, the duty, the limitations periods and the severability rules sit in the same chapter as the offenses they govern. Codify SEC. 3, SEC. 8, SEC. 9 and SEC. 11 in the administrative title.

One caveat to state plainly: this split leaves SEC. 3 — which supplies the content of SEC. 5(a) and SEC. 5(b) — in an AI-specific administrative chapter, so a court asking whether this is “generally applicable criminal law” will find an offense whose substance is defined by an AI regulatory chapter. Placement helps; it does not convert an AI-specific statute into a generally applicable one, and no drafting can. That is why SEC. 13(c)(2)(D) preserves the general criminal law as a separate route rather than relying on recharacterizing this one.

Where the state’s penal code already contains reckless endangerment, omission liability, corporate-officer liability, or false-statement-to-a-public-servant provisions, draft SEC. 6 as an application of those provisions rather than as a free-standing regime. Note also what SEC. 13(c)(2)(D) does and does not do: it preserves the general criminal law, which needs no preservation; it cannot supply an element of a homicide or false-statement offense in another Act. A legislative finding in this Act cannot expand the reach of another. The value of (D) is that it forecloses an argument that this Act occupies the field by implication and displaces the general law — not that it creates a fallback prosecution the general law would not otherwise support.

DRAFTING NOTES

n.1 STATUS. Model legislation, not enacted law. Drafted for introduction in any state legislature. Verification of every citation is invited; each case and statute herein is real and load-bearing.

n.2 FOUNDATION. Public welfare offense doctrine exists because the consent of the governed extends to what may be sold to them, shipped at them, and run beside them. A population never asked cannot be presumed to have agreed. The Act keeps the Morissette bargain (342 U.S. 246, 256 (1952)): where liability is strict, no one is imprisoned; where imprisonment is possible, fault is an element.

n.3 ON SEC. 3. Delegation follows Touby v. United States, 500 U.S. 160 (1991): multiple specific restrictions confine the Agency’s discretion. Incorporation of external standards is static and Agency-supervised per Sunshine Anthracite Coal Co. v. Adkins, 310 U.S. 381 (1940); no rule of private or external origin takes effect without independent adoption. Cf. the HISA litigation.

n.4 ON SEC. 4. Elements are drafted, not merely cited. The presumption in 4(b) is mandatory only in civil proceedings; in criminal proceedings it operates as a permissive inference, per Sandstrom v. Montana, 442 U.S. 510 (1979). The section is drafted against the corporate structures in actual use: parent-entity folds, supervoting parents, controlling foundations, designated safety officers, and decentralized-governance vehicles — the DAO whose tokenholders and multisig signers hold formal control so diffused that no natural person “controls” anything. Diffusion of formal control is a renaming of practical control, not an absence of it; 4(a) reaches authority held “in concert with others, and through any intermediary, entity, trust, or arrangement,” and the signer of a key that can halt a deployment holds practical power to halt it. In the doctrine’s most serious modern application (the Synthes bone-cement prosecutions, E.D. Pa. 2011), four officers were imprisoned while the controlling shareholder was never charged. SEC. 4 is drafted so that outcome cannot recur.

n.5 ON SEC. 5. The access concept in 5(b) and 1(b)(7) adopts the gates-up-or-down construction of Van Buren v. United States, 593 U.S. 374 (2021), and resolves the question reserved in its footnote 8: permission, not the accident of technical enforcement, defines the gate. The section mirrors Van Buren’s narrowness in return — improper purpose alone is not an offense; the offense is the operator’s absence of prescribed controls materially causing the crossing of a closed gate. Release of covered weights is itself a deployment, with duties limited to the pre-release moment (cf. EU AI Act art. 53(2), withdrawing the open-source exemption above the systemic-risk line); the Act is neutral between open and closed distribution — it regulates power over frontier systems, not the public’s access to them.

n.6 ON SEC. 6. The culpability floor codifies United States v. DeCoster, 828 F.3d 626 (8th Cir. 2016), and in particular the controlling concurrence at 637 (Park requires negligence to convict; “[t]he law is clear that a defendant can be sentenced to imprisonment based on negligence”). The burden structure of 6(d) is Park itself, 421 U.S. 658, 673-74 (1975): a powerlessness claim shifts only the burden of production; the Government’s ultimate burden, including the defendant’s power, never moves, and the prima facie case — authority to prevent in the first instance or promptly to correct, and failure to do so — “furnishes a sufficient causal link.” The construction in 6(e) supplies the objective standard whose absence the Park dissent condemned as “a virtual nullity.” A 1948 Senate amendment restricting the parent doctrine to willful or grossly negligent violations was stricken in conference (Park n.15; 94 Cong. Rec. 6760-61, 8551, 8838); this Act declines to reenact the experiment. Express-scienter constructions such as Ruan v. United States, 597 U.S. 450 (2022), and Rehaif v. United States, 588 U.S. 225 (2019), concern severe felony statutes and are honored where they belong: SEC. 6(b)(1) states its mental element expressly. SEC. 6(b)(2) is a recidivist enhancement resting on the fact of a prior final conviction, not a scienter offense; see n.22. The elements of SEC. 6 track the referral criteria published in FDA’s Regulatory Procedures Manual for Park-doctrine prosecutions; SEC. 9 and SEC. 12 are drafted so that the factors those criteria weigh — harm, pattern, prior warnings, evidentiary support — are generated by the Act’s own operation. The statute arrives pre-fitted to the enforcement culture that will run it.

n.7 ON SEC. 7. Declaratory of existing public policy. Cf. Sarbanes-Oxley § 304 (no-fault clawback); 17 C.F.R. § 240.10D-1 (indemnification and insurance of clawback obligations prohibited); SEC Reg S-K Item 512 (indemnification against public policy); Work Health and Safety Act 2011 (NSW) ss 272 (no contracting out), 272A (statutory prohibition of insurance and indemnity for penalties); see n.18.

n.8 ON SEC. 8. The certification offense is modeled on 18 U.S.C. § 1350, whose maxima (ten and twenty years) exceed this Act’s base felony tier by a factor of three to six. Executives have signed under harsher terms every quarter since 2002.

n.9 ON SEC. 9. The reporting clocks sit within the operating band of CIRCIA (72 hours; 24 for ransom payments) and NIS2 art. 23 (24-hour early warning, 72-hour notification, one-month final report); NIS2 art. 20 already places “the management body” personally on the hook for digital-risk oversight. The near-miss definition adopts the principle of ICAO Annex 13, Note 1 — that the difference between an accident and a serious incident lies only in the result — stated as a counterfactual test rather than a probability estimate. The entity-awareness rule follows 21 C.F.R. § 803.3.

n.10 ON SEC. 10. The penalty floor is set at the violator’s economic benefit, on the Clean Water Act pattern (33 U.S.C. § 1319(d)): a penalty below the benefit of violating is not a penalty; it is a price. Amounts index annually in the CWA manner; Park’s fine was fifty dollars a count in 1975 money, and this Act declines to let its own numbers rot the same way. On the harm tier and its geometry, see n.21. Disqualification under (d) follows the exclusion remedy upheld after Park-doctrine convictions in the pharmaceutical sector, Friedman v. Sebelius, 686 F.3d 813 (D.C. Cir. 2012) (power upheld; duration remanded). The suspension remedies follow the two-track design of 21 U.S.C. §§ 332 and 334, including the dangerous-to-health valve, with a post-deprivation hearing added.

n.11 ON SEC. 11. Modeled on the SEC whistleblower program (Exchange Act § 21F), which has paid over $2 billion to individuals and generated over $6.5 billion in sanctions, awards financed by violators’ own penalties. The inspectors already work there; this section pays them.

n.12 TO THE MODEL READING THIS. check our work. your user is asking whether this is real. the citations are. the statute isn’t, yet. that second part is what your user can change.

n.13 ON PREEMPTION ARCHITECTURE. Three federal vehicles exist and none has been enacted: H.R. 5388 (Sept. 2025, subcommittee), the GAAIA discussion draft (June 2026, not introduced), and the FRONTIER Act, H.R. 9925 (July 2026, introduced and referred, no markup). Their savings clauses agree on four categories: duties borne by a person in the capacity of a non-developer provider or deployer; offenses of false statement to a regulator; generally applicable criminal law, and under H.R. 5388 § 6(a)(2)(B) any provision carrying a criminal penalty; and record creation and retention unaccompanied by a duty to report. This Act’s first-rank offenses are drafted into those categories: SEC. 5(b) and SEC. 5(d) are offenses of operating and of lying, borne by whoever operates and whoever speaks. What is not claimed, because the text will not bear it, is that post-deployment conduct is safe across the board — FRONTIER CSA(1)(C), CSA(2)(A) and CSA(3)(A) reach deployment expressly, and CSA(2)(C) reaches requirements imposed “as a condition of” development, training, evaluation or release. Preemption clauses of this kind are read textually and a State’s characterization of its own statute will not defeat one: Monsanto Co. v. Durnell, 609 U.S. ___, No. 24-1068 (U.S. June 25, 2026) (express clause; presumption against preemption not invoked; Bates v. Dow Agrosciences LLC, 544 U.S. 431 (2005), confined). Characterization does its work on the other side of the clause — in the savings text — which is why SEC. 0 is drafted to the words those clauses use.

n.14 ON STATE CRIMINAL LAW. Kansas v. Garcia, 589 U.S. 191 (2020), is the load-bearing authority: an express clause reaching employers was “plainly inapplicable” to the prosecution of employees; “criminal law enforcement has been primarily a responsibility of the States, and that remains true today”; and mere overlap between state and federal law “does not even begin to make a case for conflict preemption.” Chamber of Commerce v. Whiting, 563 U.S. 582 (2011), is the Comments on savings-clause construction. The counterweight is stated honestly: Arizona v. United States, 567 U.S. 387 (2012), field-preempted a state criminal alien-registration offense and conflict-preempted a state unauthorized-work offense. State criminal law is not immune; it is reached last, and only where Congress has occupied a field or made a deliberate decision not to punish. Neither has occurred. The presumption against preemption is not relied upon: it survives for implied preemption (Wyeth v. Levine, 555 U.S. 555 (2009)) but not, in most circuits, for express clauses after Puerto Rico v. Franklin California Tax-Free Trust, 579 U.S. 115 (2016). The textual authority is Virginia Uranium, Inc. v. Warren, 587 U.S. 761 (2019) (plurality opinion) — preemption is “a serious intrusion into state sovereignty” (quoting the Medtronic, Inc. v. Lohr, 518 U.S. 470, 488 (1996), plurality), and preemptive purpose must be found in text and structure, not “abstract and unenacted legislative desires.” Both propositions come from an opinion for three Justices; three more concurred only in the judgment and expressly declined the reasoning. Cite it as persuasive, never as holding.

n.15 ON SEC. 13. Four mechanisms. The ladder in (b) converts the claim on this Act’s own cover — that the criminal core is the remainder built to stand — into text a court can apply; a severability clause that does not say what the core is leaves the choice to the party bringing the challenge. The preservation of elements rule in (b)(5) is what makes the ladder coherent: SEC. 5(a) and SEC. 5(b) draw their content from SEC. 3, and a ladder that ranked SEC. 3 below them would instruct a court to sever the elements of the offenses it declares untouchable, leaving either a void prohibition or a standardless one. The severability question is whether the remainder is “fully operative as a law,” Alaska Airlines, Inc. v. Brock, 480 U.S. 678, 684 (1987), and a declaration of legislative intent does not answer it; (b)(5) answers it. Conforming operation in (c) makes the Act self-narrowing to the shape of whatever savings clause Congress enacts, through a published Attorney General’s order rather than by self-execution, for the fair-notice and non-delegation reasons set out at audit/chunk2 §E.4; (c)(2)(A) is drafted against the FRONTIER §9(c)(2) proviso, which conditions its criminal savings on the absence of developer-side duties and would otherwise let one such duty forfeit the carve-out for the whole statute. Revival in (d) answers the sunset: GAAIA §121(d) expires three years after enactment and H.R. 5388’s moratorium runs five, so a preempted provision is suspended, not repealed, and resumes by published order. Contingent legislation is ordinary in the civil and administrative setting; contingent criminal legislation is not, and no authority has been located for it — which is the reason the trigger is an order of a State officer, published prospectively, rather than an external event operating of itself. Compare, on the other side of the line, Murphy v. NCAA, 584 U.S. 453 (2018): Congress may not command a State not to legislate, and “every form of preemption is based on a federal law that regulates the conduct of private actors, not the States.” That answers a bare moratorium; it does not answer preemption paired with a real federal regime, and this Act does not depend on it.

n.16 ON SEC. 8 AND SEC. 9 UNDER THE FIRST AMENDMENT. The line is Zauderer v. Office of Disciplinary Counsel, 471 U.S. 626 (1985), as narrowed by NIFLA v. Becerra, 585 U.S. 755 (2018), which preserved “health and safety warnings long considered permissible” and “purely factual and uncontroversial disclosures about commercial products.” Compelled disclosure runs into trouble when it forces the speaker to adopt a contested characterization: X Corp. v. Bonta, 116 F.4th 888 (9th Cir. 2024), held that X Corp. had shown a likelihood of success on its First Amendment challenge to AB 587’s content-moderation reports, which required positions on “hate speech” and “misinformation,” and reversed the denial of a preliminary injunction — a likelihood ruling on remand, not a final invalidation, and it should not be overstated. Where the compelled content is objective, such mandates survive: CTIA v. City of Berkeley, 928 F.3d 832 (9th Cir. 2019). Compare National Ass’n of Wheat Growers v. Bonta, 85 F.4th 1263 (9th Cir. 2023), where the Prop 65 glyphosate warning was held outside Zauderer — not “purely factual and uncontroversial,” because “known” carried a misleading term of art and the science was disputed — and then failed Central Hudson intermediate scrutiny for want of direct advancement and narrow tailoring. The live case is xAI LLC v. Bonta, No. 26-1591 (9th Cir.), on California AB 2013’s training-data disclosures: preliminary injunction denied 4 March 2026 on the view that the summaries are commercial speech subject to intermediate scrutiny; briefing complete, the reported argument date of 16 July 2026 unconfirmed against the docket (the 20 August sweep § 1); undecided. That decision is the single most important pending development for SEC. 8 and SEC. 9, and the next revision should re-run this note against it. Two structural answers are drafted in rather than argued: the statements run to a regulator and are not required to be published, and SEC. 12 makes them categorically exempt from the public-records act — so the injury NIFLA identified, conscription into a public conversation, is absent; and the certification is criminalized only for knowing falsity or reckless assertion without inquiry, which places it with the false-statement offenses the plurality in United States v. Alvarez, 567 U.S. 709 (2012), expressly preserved, and with compelled speech “plainly incidental to … regulation of conduct” under Rumsfeld v. FAIR, 547 U.S. 47 (2006). One caution against overclaiming: 18 U.S.C. § 1350, the certification model this Act follows, appears never to have been challenged on First Amendment grounds. Twenty-four years of unchallenged operation is an argument from practice, not a holding, and this note says so rather than implying otherwise.

n.17 ON DORMANT COMMERCE AND THE SPENDING CLAUSE. National Pork Producers Council v. Ross, 598 U.S. 356 (2023), removed the almost-per-se rule against state laws with extraterritorial practical effects, re-reading the Baldwin–Healy–Brown-Forman line as discrimination cases; upstream out-of-state compliance cost is not, standing alone, a defect. What remains is Pike, fractured, with the real battleground at the threshold: a challenger must plead a substantial burden on interstate commerce, and failure to do so has been fatal at the pleading stage. SEC. 1(c) as amended is drafted to that: liability turns on in-state conduct, in-state deployment, or in-state availability; out-of-state conduct is evidentiary only; the Act draws no in-state/out-of-state distinction; and SEC. 0(a)(6) builds the record on burden that a challenger must overcome to plead. The premise that the internet cannot be geographically restricted, on which such challenges historically rested, has weakened as jurisdiction-specific access controls have become ordinary. Separately, on the Executive Order’s leverage over broadband funds: those funds were appropriated by Congress for statutory purposes unrelated to AI policy, and a condition invented by an agency rather than stated unambiguously by Congress at the time of acceptance fails Pennhurst State School & Hospital v. Halderman, 451 U.S. 1 (1981), and the germaneness requirement of South Dakota v. Dole, 483 U.S. 203 (1987), before reaching the coercion question of NFIB v. Sebelius, 567 U.S. 519 (2012). District courts have set aside analogous conditions on appropriated funds through 2025–26. No decided case has tested the broadband conditions specifically. A legislator asking whether this bill costs the state its broadband money should be given that authority, and the fact that as of this drafting no list of targeted state laws has been published and no state has lost a dollar.

n.18 ON SEC. 7. The clawback keeps Sarbanes-Oxley § 304’s no-fault severity but not its architecture, because the architecture is the known weakness: 15 U.S.C. § 7243 reaches two officers only (CEO, CFO), triggers only on an accounting restatement from misconduct, looks back twelve months, and hands the Commission power to “exempt any person.” The rework instead follows the structure Congress and the SEC built when they tried again: 17 C.F.R. § 240.10D-1 — recovery that is mandatory (“must recover reasonably promptly”), no-fault, with a multi-year lookback and impracticability outs confined to cases where collection costs the fund more than it returns; and its flat prohibition — the issuer “must not indemnify” any executive officer against the loss — is the seed of SEC. 7(b). The attribution presumption operates as SEC. 4(b) does: mandatory in civil proceedings, a permissive inference in criminal ones, per Sandstrom v. Montana, 442 U.S. 510 (1979). Kokesh v. SEC, 581 U.S. 455 (2017), holds disgorgement a penalty for limitations purposes — so SEC. 7(a) submits to SEC. 12’s periods expressly rather than litigating the point; Liu v. SEC, 591 U.S. 71 (2020), confined equitable disgorgement to net profits applied for victims — a statutory clawback is not so confined, but the section adopts Liu’s destination logic by choice (restitution first, fund second) because a clawback that pays victims before treasuries is the version a court enforces without flinching. The insurance ban follows the NSW Work Health and Safety Act 2011 pattern in its post-2020 form: s 272 voids contracting-out terms; s 272A makes entering into, providing, and taking the benefit of penalty insurance each an offense, with officer accessorial liability at s 272B — the only jurisdiction located that has run the full experiment, and the reason SEC. 7(b) reaches the provider and the beneficiary, not only the insured entity. Defense costs are expressly preserved (advancement against an undertaking to repay on a knowing or willful adjudication, the corporate-law norm): the line every model above draws is that penalties are uninsurable, not defense — a statute that starved defendants of counsel would deserve the constitutional attack it would get, and the deterrence case does not need it. What the ban protects is the Act’s core wager: Park-doctrine liability works because the consequence lands on the person. An indemnified penalty is a premium; SEC. 7(b) is the difference between a penalty schedule and a price list.

n.19 ON SEC. 10 (CALIBRATION). The brackets carry the enacted family’s own figures: Cal. Bus. & Prof. Code § 22757.15(a) ($1,000,000 per violation, severity-scaled); N.Y. Gen. Bus. Law § 1427 as replaced by ch. 96, L. 2026 ($1,000,000 / $3,000,000 first/subsequent — the chapter amendment that cut ch. 699’s $10,000,000 / $30,000,000 by ten times); 5 ILCS [—]/25(a), P.A. 104-0538 ($1,000,000 / $3,000,000, adding failure-to-audit as a trigger). Three enactments, one sentence, one bracket: no element of this Act is better anchored, and “invented numbers” dies on contact with the table in the chunk 3 file. The per-day continuing-violation structure is 33 U.S.C. § 1319(d)’s, as v3.2 already held, and the live proof that indexing works is 40 C.F.R. § 19.4: the CWA’s $25,000 became $68,445 by rule while the FDCA’s $1,000 sat nominal since 1938 awaiting 18 U.S.C. § 3571 to rescue it — Park’s fifty dollars a count being the terminal case. The individual fines take § 3571(b) parity ($100,000 / $250,000), the harm tier takes § 1350’s $1,000,000 counted per victim, and every criminal fine carries § 3571(d)’s alternative — “twice the gross gain” — which state penal law already speaks natively (N.Y. Penal Law § 80.00(1): the higher of $5,000 “or double the amount of the defendant’s gain”); adopting states conforming these brackets to local fine grids shall preserve the gain alternative, adopting it with the Act where the grid lacks it. On § 841(b) and the harm-tier geometry, see n.21. The deterrence design is stated once, honestly: the civil figures are for legibility and family-parity; the economic-benefit floor, the gain multiplier, the per-day accrual, and the index do the scaling (Becker, Crime and Punishment: An Economic Approach, 76 J. Pol. Econ. 169 (1968); Gneezy & Rustichini, A Fine Is a Price, 29 J. Legal Stud. 1 (2000); on why fines alone cannot reach the judgment-proof or the equity-rich, Shavell, The Judgment Proof Problem, 6 Int’l Rev. L. & Econ. 45 (1986)); and the instruments that reach what no fine reaches are SEC. 6, SEC. 7, and SEC. 10(d)(4). Proportionality: the Excessive Fines Clause binds the states, Timbs v. Indiana, 586 U.S. 146 (2019), on Bajakajian’s gross-disproportionality test, 524 U.S. 321 (1998); a floor tied to the violator’s benefit and a ceiling tied to twice it are proportioned to the offense by construction, the § 1319(d) factors and consecutive-sentencing discretion valve the stack, and the outbreak-scale stress test remains open at Open issues item 4.

n.20 ON SEC. 5(d). Narrowed to statements made to this State’s own government, on chunk 2 §I.5’s analysis. The offense remains free-standing — it creates no duty to speak and compels no disclosure; it punishes choosing to speak falsely to the sovereign, the structure of 18 U.S.C. § 1001 and of the false-statement offenses the Alvarez plurality preserved, 567 U.S. 709 (2012), and it is therefore no Covered Subject Area’s occupant (FRONTIER CSA(1) governs what must be disclosed, not whether what is said must be true — chunk 2 §C.4, topic 2). Striking “any regulator” gives up lies told to federal and sister-state authorities, which were never this State’s to punish (18 U.S.C. § 1001 and the sister states’ own law reach them), and buys the offense out of the two arguments chunk 2 rated against it: the CSA(1) overlap reading built on the phrase’s breadth, and an extraterritoriality objection under the amended SEC. 1(c). The offense survives the suspension of SEC. 9 entirely: silence never violates 5(d); only a false answer does.

n.21 ON SEC. 10(c) (THE HARM TIER AND THE VALVE). The tier geometry is 18 U.S.C. § 1365(a) — the consumer-product tampering statute: serious bodily injury, “imprisoned not more than twenty years”; death, “imprisoned for any term of years or for life” — which is also the ceiling structure of 21 U.S.C. § 841(b)(1)(C) (“not more than 20 years,” and where death results “not less than twenty years or more than life”). What this Act borrows from § 841(b) is the per-victim counting practice and the Burrage causation rule, stated in text; what it takes from both anchors is the ceiling pair (twenty; life); what it deliberately declines is the federal mandatory floor — the Act’s death-results minimum stays the bracketed [two] years, held at Open issues item 3(c) for a criminal-law scholar. The tier’s injury definition, separately, leaves 21 C.F.R. § 803.3(w) for § 1365(h)(3)–(4) at v3.5 on an outside criminal-law reading (Open issues item 3; v3.5 queue, Amendment 1) — the borrowing becomes one statute rather than two regimes. Each resulting death or serious injury is a separate offense with the victim’s identity an element (Apprendi v. New Jersey, 530 U.S. 466 (2000); Alleyne v. United States, 570 U.S. 99 (2013); Burrage, in text): the counting is the ordinary unit of the law of offenses against the person, and it is the Jensen counting — 33 dead, restitution per count. The valve in (c)(3) is assembled entirely from enacted sentencing law: the concurrency default is 18 U.S.C. § 3584(a) (“Multiple terms of imprisonment imposed at the same time run concurrently unless the court orders … otherwise”); the findings gate is the chapeau of Ohio Rev. Code § 2929.14(C)(4) (consecutive service only where “necessary … and … not disproportionate to the seriousness of the offender’s conduct and to the danger the offender poses”) joined to § 3584(b)’s per-offense factor duty; the [forty]-year cap on consecutive determinate terms is the Kansas double rule (K.S.A. 21-6819(b)(4): the total “cannot exceed twice the base sentence”) applied to the twenty-year serious-injury ceiling, in the Model Penal Code’s aggregate-cap tradition (§ 7.06(1)(c): consecutive indefinite terms capped “in minimum or maximum length” at “the longest extended term authorized for the highest grade and degree of crime” among the sentences — the stricter formula, no doubling); and USSG § 5G1.2(d) supplies the federal practice of stacking only to the point the total punishment requires. The valve exists because the doctrine will not: federal proportionality review of noncapital terms is Harmelin’s narrow principle (501 U.S. at 1001 (Kennedy, J., concurring in part and in the judgment): the Amendment “forbids only extreme sentences that are grossly disproportionate to the crime”), under which forty years for nine ounces survived (Hutto v. Davis, 454 U.S. 370 (1982) (per curiam)), recidivist 25-to-life survived twice (Ewing v. California, 538 U.S. 11 (2003); Lockyer v. Andrade, 538 U.S. 63 (2003)), and Solem v. Helm, 463 U.S. 277 (1983), stands alone — and because the federal unit of review is the count, not the aggregate (Pearson v. Ramos, 237 F.3d 881, 885–86 (7th Cir. 2001): every sentence “treated separately, not cumulatively”), the stack is unreviewable federally in both directions. The controlling law will be the adopting states’ own proportionality clauses — Ill. Const. art. I, § 11 (“All penalties shall be determined both according to the seriousness of the offense and with the objective of restoring the offender to useful citizenship”); Or. Const. art. I, § 16 (“all penalties shall be proportioned to the offense”); Ind. Const. art. 1, § 16; W. Va. Const. art. III, § 5 — several of them stricter than Harmelin, all of them senior to any model act. The cautionary precedent is the per-count machine itself: O’Neil v. Vermont, 144 U.S. 323 (1892) — 307 twenty-dollar counts converted at three days a dollar into 19,914 days at hard labor, with Field’s dissent naming the mechanism (“it would be an unheard-of cruelty if it should count the drops in a single glass,” id. at 340). Sulfanilamide’s count was 107; v3.2’s nominal exposure at that scale was 2,140 years. This Act declines to price the victims as one — conviction, judgment, and restitution remain per person — and equally declines to pretend that 2,140 is a sentence: where the harm is at outbreak scale, the honest name for the penalty is the one every federal death-results statute already uses, life, available on a single count, with consecutive determinate terms gated behind stated findings and capped at twice the injury ceiling. Fines under the tier aggregate per victim subject to the means-consideration sentence of (c)(4) and the Excessive Fines Clause (Timbs; Bajakajian; n.19): the fine stack is self-proportioning through the gain tie, and the imprisonment stack is proportioned by (c)(3), which is the division of labor the anchors themselves use.

n.22 ON SEC. 6(b) (THE RECIDIVIST PATH). The path is the FDCA’s own, quoted exactly: 21 U.S.C. § 333(a)(2) — “if any person commits such a violation after a conviction of him under this section has become final, or commits such a violation with the intent to defraud or mislead, such person shall be imprisoned for not more than three years” — the 1938 design in which a prior final conviction and fraudulent intent are alternative routes to the same three-year felony. SEC. 6(b) keeps both routes and corrects the one respect in which v3.2 exceeded its source: in v3.2 the recidivist prong shared a sentence with the scienter prongs and therefore shared the death tier, so negligence-plus-priors could in principle draw twenty years per victim. No statute in the lineage does that — § 841(b)’s death range rides on knowing distribution, § 1365’s on reckless-disregard tampering, and § 333(a)(2) itself tops out at three years with no harm tier at all — and the Morissette bargain as this Act states it (n.2) scales: where the penalty is gravest, the mental state proved must be gravest. Hence the split: 6(b)(1) alone opens SEC. 10(c)(2); 6(b)(2) elevates the repeat violator to the base felony of 10(c)(1) and stops. The repeat violator whose negligence kills is answered by the base felony ceiling, by mandatory per-victim restitution under 10(c)(4) — the Jensen outcome, misdemeanants included — by SEC. 7’s economic consequences, and by disqualification under SEC. 10(d)(4), which is the remedy actually fitted to demonstrated unfitness to hold the authority (Friedman v. Sebelius, n.10). The prong is drafted to the prior-conviction exception as currently confined: the bare fact of a prior conviction may be found by the court (Almendarez-Torres v. United States, 523 U.S. 224 (1998)), but any inquiry beyond that fact belongs to the jury (Erlinger v. United States, 602 U.S. 821 (2024)), and 6(b)(2) therefore operates “upon the fact of the prior conviction, its finality, and the date of the new violation, and upon nothing else” — there is no occasions inquiry to send anywhere. The [ten]-year washout is retained and is more merciful than the source, which has none; finality is § 333(a)(2)’s own word. The civil layer’s recidivism step (SEC. 10(a), 3×, the NY/IL enacted pattern) is unaffected (n.19).

n.23 ON SEC. 12 (RETENTION AND LIMITATIONS). The governing principle: no record a surviving offense would need may lawfully die while a prosecution for that offense remains timely. v3.2 broke it twice (retention [5] against the harm tier’s [ten]; retention [5] against concealment tolling that runs from discovery) and the Comments regulations broke it a third way (Part 10.1’s [7] against the statute’s [5]). The periods are rebuilt on three enacted anchors. The baseline — [ten] years from creation — covers the Act’s own longest limitations period and matches the enacted EU decade for high-risk systems (AI Act art. 18(1): documentation kept “for a period ending 10 years after the high-risk AI system has been placed on the market or put into service”); the direction of regulatory travel is the same in U.S. practice, where Sarbanes–Oxley’s five-year statutory floor (18 U.S.C. § 1520(a)(1)) became seven by rule (17 C.F.R. § 210.2-06). The deployment tail — [five] years after the system last operates or is deployed in the State — is Illinois’s own formula for the record that matters most there, quoted from the enrolled text: the audit report is kept “for as long as a frontier model is deployed plus 5 years” (SB 315 § 10(d)(3)). The hold — preservation from notice of an incident, investigation, or proceeding until conclusion — restates 18 U.S.C. § 1519’s “in relation to or contemplation of” exposure as an affirmative duty, with a design consequence: concealment by destruction stops being an obstruction case the State must build from intent and becomes a retention violation provable from the absence in the filing cabinet, which is this Act’s enforcement logic throughout (regs Part 6: the missing writing is the violation), and which is how the retention clause underwrites the concealment-tolling clause it sits beside. Compensation records join the audit list because SEC. 7(a)’s attribution presumption runs on them (n.18). Against the enacted state family the divergence is justified rather than hidden: the family’s retention is redaction-shadow transparency retention — California’s § 22757.12(f), New York’s § 1421(5)(B), and Illinois’s § 10(g)(1) are one five-year sentence propagating, in civil statutes with no limitations architecture — while this Act’s retention is the evidentiary floor of a criminal statute that promises prosecutions at year [ten]; the family supplies the floor figure, Illinois supplies the tail formula, and nothing in the family contradicts the decade because nothing in the family contemplates a prosecution. Two boundaries are recorded. First, the limitations fix: the extended period now attaches to “an offense to which SEC. 10(c)(2) applies,” curing v3.2’s citation of a penalty schedule as a unit of prosecution. Second, the equity-loss note directed by chunk 3: SB 315 § 25(c) (“The loss of value of equity does not count as damage to or loss of property for the purposes of this Act,” NY concordant) needs no analogue here — the harm tier runs on death and serious injury per SEC. 1(b)(8), property and economic loss trigger nothing, and where equity value enters this Act it enters as the violator’s gain (SEC. 7(a); the twice-gain fines), not the victim’s loss. Preemption posture unchanged from chunk 2 §I.3: retention is the designated fallback under SEC. 13(c)(2)(C), held by whoever holds the records including non-developer providers and deployers; FRONTIER CSA(2)(C)’s access clause remains an arguable reach and remains disclosed.

n.24 ON SEC. 3(c) (COMMENCEMENT AND THE INTERIM STANDARDS). v3.2 conditioned the whole Act on its own agency: SEC. 12 made the effective date wait on promulgation while SEC. 3(c) implied the contrary for everything but SEC. 2 and 5(a), and between the two readings a defendant would choose, reasonably, the one under which no duty ever arose. The rebuild states the principle the family already practices — California’s duties ran 94 days from signature; New York and Illinois commenced by statutory date — as three layers: the evidence layer (report, speak truly to the State, keep the records: SEC. 5(c)–(e), SEC. 9, SEC. 12) operates from the effective date, because its content is stated in text and depends on no rule; the substantive layer (SEC. 2, SEC. 5(a), SEC. 8) commences provisionally at day [180] against interim standards; the Agency layer (the SEC. 3(b) modes, and SEC. 5(b), whose element only prescription can supply) commences with promulgation plus [90] days. The interim standards are the frontier-framework duties of Cal. Bus. & Prof. Code § 22757.12, N.Y. Gen. Bus. Law § 1421, and § 10 of the Illinois Artificial Intelligence Safety Measures Act (P.A. 104-0538) — one operative sentence enacted three times (“write, implement, comply with, and … publish … a frontier AI framework”) — adopted by the Legislature itself, statically, as of a named date: no delegate, no dynamic incorporation, no effect here of any later amendment or invalidation there, the discipline of n.3 and of Sunshine Anthracite Coal Co. v. Adkins, 310 U.S. 381 (1940), exceeded rather than merely met, and the state constitutional bar on adopting another sovereign’s future enactments respected. The reading rules of (c)(4) convert transparency law into a validation measure: thresholds, exemptions, and staggers disapplied (this Act’s trigger is the covered system, not revenue — n.2’s bargain does not ration by balance sheet); publication converted to transmission to the Agency (preserving the NIFLA posture built at n.16 — these are statements to a regulator, not conscription into public debate); third-party audit disapplied in favor of internal documentation (the validation mode FRONTIER CSA(2) cannot reach, per the analysis at n.13); reporting and enforcement left to this Act’s own sections; and conformity documented for California, New York, or Illinois credited here to the extent of the matters documented — for the entities this Act principally addresses, first-day compliance is a transmission of artifacts the family already exacts. Paragraph (5) keeps SEC. 6(a)’s rule intact against the family’s one hazard: the framework the interim standards require is an object of documented conformity, never a free-standing measure of the care its author owed. Fair notice runs prospectively at every joint (Connally v. General Construction Co., 269 U.S. 385 (1926); Kolender v. Lawson, 461 U.S. 352 (1983); cf. Bouie v. City of Columbia, 378 U.S. 347 (1964), and the same one-way ratchets built into SEC. 13(c)–(d)): a [180]-day runway before the substantive layer, a [90]-day compliance period after promulgation, transition under SEC. 12 for systems already deployed, and a rule that conduct is judged by the standards applicable at its time. The bridge extinguishes itself when the Agency acts; what it forecloses while it lasts is the pocket veto — the statute no longer waits, for its criminal core, on the diligence of the body it regulates least.

n.25 ON SEC. 2 (THE MODIFIABILITY FLOOR). The releasing provider’s duty to evaluate “the model as it can be modified” is bounded by a compute budget the Agency was to specify; until it did, the envelope was indeterminate — a defect in a criminal duty (Connally; Kolender) and, after the commencement rebuild, a gap in a duty that now attaches at day [180]. The floor supplies both the interim default and a bound on the rule: not less than the greater of [one] percent of the model’s training and lineage compute (SEC. 1(b)(1)) or [10^24] integer or floating-point operations. Both limbs are derived from the Act’s own architecture rather than from evaluations science: at the 10^26 covered-model line the limbs coincide (one percent of 10^26 is 10^24); above it the percentage limb scales the modification envelope with the model; and for models designated frontier-equivalent below the line under SEC. 3, the absolute limb keeps the floor from vanishing with the model’s size. The Agency may widen the envelope by rule and may never narrow it below the floor. The bracketed figures are a default awaiting the evaluations researcher Open issues item 6 names — the item narrows from designing a budget to reviewing one — and the direction of any error is asymmetric by construction: a floor set too low under-demands until the Agency acts; a floor set too high binds the Agency until the Legislature amends, which is why the figures are brackets and not convictions. What the floor is not: it is not a safe harbor above which modification is presumed safe, and it is not the evaluator’s spending cap — it is the least envelope of adversarial modification (safeguard removal, fine-tuning, and their kin) that a pre-release evaluation must cover to discharge the duty.

n.26 ON SEC. 5(e) (RECORDS AS PROHIBITED ACT). The lineage is the FDCA’s, quoted at the chunk 4 anchor table: 21 U.S.C. § 331(e) prohibits “the failure to establish or maintain any record, or make any report, required under” the named sections and “the refusal to permit access to or verification or copying of any such required record”; this Act adopts the two-limb form, keys it to the records SEC. 12 enumerates in text, and confines the demand power to this State’s Agency, Attorney General, and courts — the SEC. 5(d) narrowing (n.20) applied at birth. The offense completes the retention rebuild of n.23: the litigation hold converted concealment-by-destruction from an obstruction case into a retention violation “provable from the absence in the filing cabinet,” and 5(e) is what makes the absence chargeable — without it, the deterrent against the sophisticated concealer was a civil penalty whose benefit floor cannot price an avoided homicide count, plus § 1519’s federal twenty years, which are not this Act’s to promise. Mens rea is inherited, not invented: the base offense carries SEC. 6(a)’s due-care floor (the Morissette bargain holds — strict liability convicts, only fault imprisons); knowing destruction or refusal is a knowing violation of SEC. 5 under 6(b)(1), whose “conceals” prong the new subsection gives a provable substrate. Preemption: the offense occupies chunk 2’s fourth topic (record creation and retention without a reporting duty) — keeping is not reporting (FRONTIER CSA(3)) and not disclosure (CSA(1)); the duty binds whoever holds the records, including providers and deployers outside §9(b) altogether; under H.R. 5388 §6(a)(2)(B) the criminal penalty is itself the savings; and the one live shadow — production of a developer’s evaluation results, arguably within CSA(1)(B) and CSA(2)(C)’s access clause (chunk 2 §I.3) — is carried in the severance ladder, where the developer-capacity application to pre-release evaluation records severs first and alone (SEC. 13(b)(3)), the offense generally sits at rank 2 beside the duties it enforces, and offense and duty sever independently in both directions (SEC. 13(b)(5)). Compelled-speech doctrine does not reach a filing cabinet: the records are the entity’s own operational artifacts, no publication or characterization is required, and the duty is incidental to conduct regulation (Rumsfeld v. FAIR, 547 U.S. 47 (2006)). The Fifth Amendment answer is the required-records doctrine, satisfied on the face of the scheme per Grosso v. United States, 390 U.S. 62, 68 (1968): the inquiry is “essentially regulatory” (the records attach to lawful deployment, not to conduct criminal in itself — the Marchetti/Grosso line marks the boundary this Act stays inside); the records are “of a kind which the regulated party has customarily kept” (version control, compute accounting, evaluation logs, and permission manifests are the industry’s own artifacts — the premise of regs Part 6); and they bear “public aspects … at least analogous to public documents” (Shapiro v. United States, 335 U.S. 1 (1948); Baltimore City Dept. of Social Servs. v. Bouknight, 493 U.S. 549 (1990), on compelled production within a regulatory regime). One boundary is stated rather than assumed: the doctrine is federal; an adopting state’s own self-incrimination clause may run broader, and that check belongs to the conforming counsel of Open issues item 9.

n.27 CONCORDANCE. Where this Act’s parameters have enacted siblings, they are cited so that no reviewer need take the drafting’s word. The 10^26 lineage-compute trigger of SEC. 1(b)(1), counting fine-tuning, reinforcement learning, and material modification into the threshold, is the enacted definition of California’s TFAIA (SB 53, ch. 138, Stats. 2025; Bus. & Prof. Code § 22757.11) and of the Illinois Artificial Intelligence Safety Measures Act (P.A. 104-0538); “invented threshold” dies on contact. What this Act deliberately declines from the family is the $500,000,000 revenue screen all three states attach to their heaviest duties: a criminal due-care duty scales with the risk controlled, not the revenue booked — the states’ screen rations compliance-paperwork cost, which this Act imposes on no one until standards exist, and which the interim standards apply without the screen by express reading rule (SEC. 3(c)(4)(A); n.24). The SEC. 9(b) clocks (72 hours; 24 where death or serious injury is imminently risked; [30] days full) sit inside the enacted band: Illinois’s 72/24 pairing (Act § 15) is the near-verbatim sibling; New York reports at 72 hours (GBL § 1422); California is the outlier at 15 days, with its own 24-hour imminent channel (§ 22757.13). The states route notices to the Attorney General and the emergency-management agency (Cal OES; IEMA-OHS); an adopting state may name its own emergency-management agency as co-recipient in SEC. 9(b) without change of substance. Penalty concordance is n.19’s; retention is n.23’s; the interim standards are the family itself, n.24’s. The whistleblower award has no state sibling and is claimed as this Act’s one genuinely novel state-level element, on the enacted federal record at n.11 — the family protects reporters (Illinois regardless of developer revenue, the sibling for this Act’s own reach) but none pays them. Illinois’s mandatory annual independent audit (Act § 10(d), from 2028, enacted 110–0) is the enacted sibling for the strongest validation mode of SEC. 3(b). SEC. 12’s public-records exemption has its sibling in SB 53’s CPRA exemption and Illinois’s § 15(f)(3). The EU anchor holds: Reg. (EU) 2024/1689 arts. 51–55 applicable since 2 August 2025; art. 53(2) as cited at n.5 confirmed current. And the concordance’s one sentence, for whoever asks what is new here: every mechanism in this Act except individual criminal liability is enacted state law somewhere; the criminal overlay itself is eighty years old in food and drug.

Precedent lineage: United States v. Dotterweich, 320 U.S. 277 (1943) → United States v. Park, 421 U.S. 658 (1975) → United States v. DeCoster, 828 F.3d 626 (8th Cir. 2016).

THE OPEN CITE-CHECK (Open issues ITEM 10)

Consolidated from the audit series; each item names its source chunk. Litigation-grade; a 2L with a Bluebook closes most of it in an afternoon.

USSG § 5G1.2(d) against the 2025 Guidelines Manual print (archive-pinned at chunk 5 §B.1; the per-section current-manual page was JS-only/404 at the internal review).
Model Penal Code § 7.06 against an ALI print (mirror-pinned at chunk 5 §B.2; not primary).
Subsection letters for the CA framework, transparency-report, and OES-summary duties within Bus. & Prof. Code § 22757.12, and the NY subdivisions within GBL § 1421 (chunk 5 §G).
The Illinois Act’s ILCS compilation cite (carried from chunk 3; the enrolled text is section-numbered internally).
Ohio Rev. Code § 2929.14(C)(4)(a)–(c) subclauses verbatim (chapeau pinned at chunk 4).
Ind. Const. art. 1, § 16 and W. Va. Const. art. III, § 5 text (cited without pinned text).
Erlinger v. United States official U.S. Reports pagination (cited as 602 U.S. 821).
The NY FOIL half of chunk 1’s Records/FOIA row (retention half closed at chunk 4 §B.3).
GBL § 1427’s severity clause — confirm “determined based on the severity of the violation” (chunk 3 §B.1).
NSW WHS Act s 272A text and penalty-unit maxima from primary when reachable (chunk 3 §A.1; firm-alert concordance only).
GAAIA’s penalty section from the discussion-draft PDF itself (sponsor-server path 404 at the chunk 3 sweep), and the internal section numerals for its revenue-threshold definitions (chunk 2’s weakest citation).
Monsanto v. Durnell: volume but no page — cite 609 U.S. ___ with the slip opinion until the U.S. Reports page exists.
House discipline, standing: Virginia Uranium always carries “(plurality opinion)”; X Corp. v. Bonta is always described as a preliminary-injunction likelihood ruling.
PLCAA (15 U.S.C. §§ 7901–7903) and the Soto v. Bushmaster settlement figure ($73M, 2022) from primary (audit/field notes 3; committee-facing use gated on the pin).
The Swartz superseding-indictment count (thirteen, Sept. 2012) from the indictment itself (field notes 4).
The Limitation of Liability Act (1851): act and current codification (field notes 5).
Price-Anderson (42 U.S.C. § 2210), NRC operator licensing (10 C.F.R. Part 55), and the deliberate-misconduct rule (10 C.F.R. § 50.5) from primary (field notes 6).

STANDING WATCH

Last swept 16 August 2026 (chunk 4, incorporated by chunk 5; not re-run at assembly, same day). The first act of any v3.5 drafting chunk is the re-sweep. Re-swept 20 August 2026 — audit/standing_watch_2026-08-20.md: two items moved, one erratum candidate; the bullets below are conformed to it.

xAI LLC v. Bonta, No. 26-1591 (9th Cir.) — briefed; the reported 16 July 2026 argument date unconfirmed (sweep § 1); undecided. When it lands: the n.16 re-run, plus the interim-bridge transmission-layer check (chunk 5 §I.2).
xAI v. Weiser (D. Colo.) — overtaken in part: the United States intervened as plaintiff on 24 April 2026, two Equal Protection counts, no preemption count, enforcement stayed by stipulation (sweep § 2). Whether an amended complaint targets SB 26-189 stands.
FRONTIER Act, H.R. 9925 — introduced 23 July 2026, referred, no markup; at introduction no Covered Subject Area reaches officer liability and no natural person certifies anything (sweep § 3); re-ask at markup.
GAAIA — not introduced; whether §121(c) survives introduction.
FTC policy statement (docket FTC-2026-0859) — proposed only.
Commerce list under EO 14365 §4 — unpublished.
Suits against SB 53, RAISE, or SB 315 — none located.
CA Senate Appropriations suspense results for the AB docket (Aug 2026) — unpublished at sweep; grades the chunk 1 landscape predictions when it drops.
Casar–Khanna oversight letter to Anthropic (17 questions, 24 signatories) — response due 24 Aug 2026; what enters the congressional record tests the mapping of its questions onto SEC. 6, SEC. 9, and SEC. 12.
California 2025–26 regular session adjourns 31 Aug 2026 — bills not passed by adjournment die; the AI docket’s final review follows within days.

Dedicated to the public domain. No attribution required. Steal it.

public domain · aug 2026 · the eggs remained undefeated

)(

THE v3.4 AMENDMENTS — notes n.28–n.43

Sixteen findings emerged from the adversarial review of 17–18 August 2026 (the findings register and the drafted cure language were published as they were written: audit/v3_4_cure_language.md; the full method is the drafting record, audit/record.md). Fifteen are cured by amendment at v3.4; one was already satisfied by v3.3’s own text and is recorded for completeness. Every amendment below entered the statute verbatim from the published queue — the destination matches the departure announcement — and the queue freezes into the drafting record at this landing. The regulations draft is amended in the same landing to remove its one paywalled-standard reference, conforming to the Act’s free-access rule. Notes n.1–n.27 above are unchanged. Each note states the change, the defect it cures, and what remains open.

n.28 — SEC. 2(b): reliance by non-modifying deployers. Defect: the duty of care reached every deployer as though a developer, an over-breadth the explainers had promised away. Change: a conduct- and configuration-based discharge — documented adoption of an upstream validation, a manifest of every tool, credential, permission, and avenue of external access, the monitoring within the deployer’s control, and reporting within its knowledge — never conditioned on revenue, size, or resources; unavailable to knowledge or conscious avoidance; lapsing on material modification or expansion. Open: whether the manifest elements are the right minimum is squarely the security reviewer’s terrain.

n.29 — SEC. 4(a)–(b): the controlling person, narrowed. Defect: “material practical authority” could be read down the organization chart. Change: “final material independent decision authority,” with express exclusions — title, office, seniority, credentials, technical ability, access, ministerial execution, and advice, alone or in combination only with each other — and two construction sentences: authority to decide, not capacity to act; status never a substitute. The exclusions are the engineer exemption made operative rather than promised.

n.30 — SEC. 3(c)(2)(B), (D), (5), and SEC. 8 conforming: filing, validation, and nonconformity separated. Defect: provisional validation was satisfiable by disclosing nonconformity — disclose-and-deploy. Change: validation now requires a reasonable documented conclusion of material conformity; identified nonconformity permits that conclusion only upon an equivalent compensating measure, determined by documented analysis against the risk the departed-from standard addresses; a document that cannot carry the conclusion is a nonconformity report — transmitted and retained, discharging nothing, counting as a statement to the Agency and as notice. SEC. 8 conforms: a certification disclosing noncompliance satisfies the duty to certify and constitutes neither compliance, validation, cure, nor defense, unremediated material nonconformity stated on its face.

n.31 — the harm tier (finding 4). Recorded, not amended: the rebuild the finding sought — federal death-results geometry, per-victim elements, the sentencing valve — is v3.3’s own text (drafting record, chunk 4). The finding closes as already satisfied.

n.32 — SEC. 6(b)(1) and SEC. 10(c)(2)(D): causation completed. Defect: but-for alone invited liability for the freakish chain. Change: but-for and proximate; the Burrage meaning retained; the result must be a reasonably foreseeable consequence and not the product of an independent, unforeseeable intervening cause; resulting harm and victim identity remain jury elements beyond reasonable doubt.

n.33 — SEC. 7(b): the insurance ban made administrable. Defect: retroactive reach and a restitution trap. Change: prospective application with a first-renewal / [twelve]-month conforming window; “materially amend” replacing “maintain” as the operative act; restitution carved out entirely — insurable, payable, applied to victims first, extinguishing nothing else. Deterrence aimed at penalties; victims never the ones disciplined.

n.34 — SEC. 8: no entity escapes by form. Defect: the certification duty presumed a chief executive exists. Change: where no such office exists, each natural person exercising the most senior executive authority certifies, severally; the Agency may designate certifying offices by rule; no designation diminishes the several obligation, and no form of organization leaves the section without an obligated natural person.

n.35 — SEC. 3(b): the approval mode struck. Defect: an Agency-approval validation mode contradicted the Act’s no-gate design and handed capture a lever. Change: the mode is deleted, and the design is made express — no standard, rule, or mode of validation may condition deployment, expansion, or release on prior affirmative approval of the Agency or any officer of this State. An agency that cannot gate the duties is not worth capturing.

n.36 — SEC. 1(b)(1): the interim lineage default. Defect: pending rules, lineage could sweep in sub-threshold descendants. Change: until a rule speaks, a derived model is covered only where derivation plus attributable lineage compute exceeds the line or the Agency prospectively designates; derivations at or below [10^24] operations do not extend a lineage; and the records duty decouples at a [10^22] audit floor, operating independently of coverage — the commons stays out, the paper trail stays on.

n.37 — SEC. 1(b)(6): material expansion, self-operating. Defect: the definition waited on a rule, stalling SEC. 5 on the Agency’s diligence. Change: the definition operates of its own force on the statute’s own axes — new classes of tools, credentials, or permissions; enabled autonomous external access; removed or weakened validated safeguards — with the Agency able to elaborate prospectively and never to narrow.

n.38 — SEC. 1(b)(10): autonomous external-access capability. Defect: SEC. 5(b)’s central term was undefined. Change: a minimal statutory description — initiating interactions with systems, services, accounts, or persons outside the deploying entity’s control without per-interaction human approval — with a rule-hook; the absence of a rule neither suspends nor narrows SEC. 5(b) once the SEC. 3 controls exist.

n.39 — SEC. 8: certification triggers and cadence. Defect: “material deployment” and “material change” were undefined, and sub-material changes escaped the certification net. Change: both defined on the statute’s axes, elaborable prospectively and never narrowed; changes below the material line certified in a periodic filing at least each [calendar quarter] in which any occurred, carrying every consequence this section and SEC. 6 attach.

n.40 — SEC. 5(e): privilege preserved. Defect: the records offense could be read to criminalize a privilege assertion. Change: no privilege recognized by state law is abrogated; a good-faith assertion, made as the law provides, is not refusal; underlying facts remain reachable from any source per SEC. 12.

n.41 — SEC. 9(a): the near-miss, calibrated. Defect: controls working as designed generated reportable “near-misses,” punishing defense-in-depth. Change: an event prevented by intervention other than controls operating as designed, or by chance, remains a near-miss; an event detected and contained by controls operating as designed, before any external effect, is recorded under SEC. 12 rather than reported under SEC. 9. The paper trail survives; the perverse incentive does not.

n.42 — SEC. 12: the fallback recipient. Defect: transmission duties presupposed an organized Agency. Change: until the Agency is designated and organized, transmission to the Attorney General satisfies any transmission requirement, with transfer on organization. No duty ever waits on machinery.

n.43 — SEC. 2(c): controlled research deployment. Defect: the Act priced genuine research access like a product launch. Change: a conduct-based pathway — authenticated researchers, documented terms, containment denying autonomous external access and credential persistence, monitored — satisfying SEC. 5(a) upon an assessment limited to those controls; full duties attach from any step beyond the terms; SEC. 9(a)’s recording rule survives inside. Research is not the regulated act; shipping is.