Proposals — the drafted repairs, keyed to v3.4

Superseded in part, 27 August 2026. The Act is now at v3.4.2 — statutory text, annotated. The defect this section was opened to track, that SEC. 6(a) could not be pleaded as drafted, is repaired; the section and subsection numbering is corrected throughout and the findings at SEC. 0 are renumbered and extended.

The three live pages in this section are keyed to v3.4 and have not been reconciled item by item against v3.4.2. Their counts — sixty-nine open items, twenty-three drafted amendments, none adopted — describe v3.4 and are no longer the state of the Act. They are left standing rather than quietly rewritten, because a revision record that edits itself is not a record. The current list of what is open is at the back of the annotated text: six questions, each marked in the statute at the provision it concerns.

Reviewing? You are not expected to read this file top to bottom. It is the working drafting record — entries sit in working order, not numeric order, and several carry HOLD or amendment blocks. The one-page index of every open item, and who can close it, is the worklist; start there. This file’s working labels map to that register’s labels so the two never disagree in substance: *decision owed = DECISION NEEDED; not drafted / for the … topic = HELD; adopt-ready = DRAFTED; ⚠ amendments required before landing = NEEDS CHANGES FIRST; from the internal review, unchecked and from intake, unchecked = UNCHECKED. The one-page index of every item is the worklist.*

STATUS — OPEN QUEUE. Nothing below is yet in the statute. The operative text remains model_act_v3_4.txt as tagged. This file holds proposed amendment language for the next revision, keyed to v3.4 with exact anchor quotes for splicing; entries are adopted, modified, or rejected at v3.5, and the file then seals as that revision’s drafting record — the life cycle the v3.4 file completed on 19 August 2026. Bracketed matter remains an adopting-state choice. Not legal advice; nothing here is described as ready for introduction.

Convention: ANCHOR quotes v3.4 verbatim so the edit lands mechanically. STRIKE/INSERT gives the operation. NEW TEXT is the full inserted language.

⚠ HOLD — the internal review of 22 August 2026 supersedes parts of this queue

An in-house pre-review across the five topics (the internal review) returned seven findings graded fatal, four in the tagged statute and three in drafting proposed here, and it identified required amendments to Amendment 6 and Amendment 7 before either may land. No entry in this file should be spliced into the statute until the corresponding sweep finding is resolved. In summary:

Amendment 6 and Amendment 7 each carry a ⚠ AMENDMENTS REQUIRED block inside the entry itself — the full lists live there, beside the text they amend, and are not repeated here. Neither cure may land until its block is discharged.

Amendment 1’s held-open bifurcation — answered no. See the entry below.

A new Decision 4 records the jurisdictional finding, which is the most consequential thing the internal review produced.

Process rule adopted: every entry in this queue must carry a one-line administrative load note before adoption. Amendment 7 added two rulemakings and a securities-analyst coverage inquiry without anyone in the fiscal topic being asked.

CURES 8–16 are the internal review’s own drafted responses, filed 22 August 2026 and marked from the internal review, unchecked, not maintainer-drafted. Every ANCHOR in them was verified verbatim against the tagged statute, each occurring exactly once. They have not been through the scrutiny the v3.4 cures received, and they are published in that state deliberately: a hypothesis about the fix, not settled drafting.

What this means for v3.5. The queue now holds sixteen cures and four open questions, and the defects reach the offense the Act exists to create (SEC. 6), the authority to obtain records (SEC. 10), the commencement of the only offense matching the 2026 conduct (SEC. 5(b)), and the Act’s jurisdictional reach (Decision 4). On the internal review’s findings, v3.5 is a rebuild rather than a splice, and the maintainer’s decision on that is owed before assembly begins.

Decision 1 — SEC. 3(c)(4): does Connecticut become a fourth interim standard?

Status (24 Aug 2026, maintainer): parked by decision — no ruling until the Connecticut act is retrieved and read (retrieval list). Working default: three interim standards suffice; the read confirms or overturns it.

Resolved (24 Aug 2026, evening, under the same ruling’s terms): the retrieval and read are done. Connecticut’s enacted act — P.A. 26-15 (2026) — adopts the frontier definitions (the 10²⁶ operations line; the five-hundred-million-dollar revenue tier) but attaches to frontier developers only a whistleblower-channel duty (its § 2). It carries no due-care corpus a frozen interim standard could adopt. Three interim standards stand. Collateral finds land at their owners: the § 33(e) anti-defense clause (the half-statute page); the officer-knowledge quarterly report (already owned by the census); the failed S.B. 2’s NIST defense (⚠ inference from the bill file and analysis; enactment-status check queued).

Opened 21 August 2026 by E16. Not a cure — a drafting decision, held here rather than made silently, because it changes the tagged statutory text and E10 forbids editing a tagged file outside a revision.

The fact. Connecticut SB 5 was enacted 27 May 2026. It uses this Act’s own threshold — computing power greater than 10²⁶ integer or floating-point operations — with a “large frontier developer” tier at $500,000,000 in annual gross revenue. SEC. 3(c)(4) currently adopts three enacted state laws. There are four.

The argument for adopting it. SEC. 3(c)(4) is drafted to track the enacted family, and a fourth member of that family now exists on an identical threshold. Omitting it invites the reasonable question why, and a reader who finds the omission before the file explains it will assume the project did not know — which, until 21 August, was true.

The argument against. Connecticut’s frontier provision is not the same kind of duty. The three adopted standards impose safety-framework obligations on the developer. Connecticut’s operative requirement is an internal reporting channel: anonymous employee reports of catastrophic risk that “shall be shared with the officers and directors of the large frontier developer at least quarterly,” with a carve-out withholding a report from an officer it accuses — and no duty of any kind attaching to those officers. Adopting it as an interim standard would import a whistleblower mechanism into a slot built for framework duties, and SEC. 9 and SEC. 11 already cover reporting and whistleblower protection from a different direction.

The third option, which may be the right one. Adopt nothing, and instead cite Connecticut in the Comments as the closest any legislature has come to the vacancy this Act fills — a statute that puts catastrophic-risk information into named officers’ hands quarterly and asks nothing of them. That is worth more to this project as an exhibit than as an adopted standard.

What is already done, pending the decision. The absence is now explained where a reader will look for it, at the adopted texts, so it reads as a decision rather than a gap. The full row is at the bill census.

Status: open. Decision owed at v3.5. Do not edit the tagged v3.4 text.

Decision 2 — SEC. 2 / SEC. 9: does the duty reach an evaluation run with safeguards disabled?

Donor note (24 Aug, evening): the Apollo Research primer *AI Behind Closed Doors (in hand, key sections read) surveys twenty-plus legal texts and finds “the term ‘deploy’ could be interpreted more broadly than ‘public release’ … in some cases … explicitly encompass[ing] ‘internal use’” — while itself cautioning it assesses rather than recommends the reading. Its core finding is this question’s premise stated as a field-wide gap: “the governance of the internal deployment of highly advanced frontier AI systems appears absent.”*

Donor note (25 Aug): Kierans, Casper & Ghosh, *Intelligence Is Not the Bottleneck (2026, in hand, read), locates the machinery this question depends on outside the developer entirely: deliberative processes “whose outputs can shape the evaluation regimes maintained by AI Safety Institutes and the third-party auditing ecosystem.” If evaluation regimes are maintained by institutes and auditors rather than by the firm under evaluation, then the conditions of an evaluation are a governable object, and the question of whether a duty reaches an evaluation run with safeguards disabled is answerable in principle rather than only in hindsight. The paper’s own framing of the gap, quoting Hadfield & Clark (2023), is the one this Act sits inside: “the technical deficit of conventional regulation and the democratic deficit of industry standards.”*

Donor note (25 Aug, and the strongest this question has): the developer has now asked a legislature for the answer this question proposes. On 21 August 2026 OpenAI asked California to amend SB 53 so it reaches frontier models “still in training or evaluation,” with developers obliged to monitor them for potential serious incidents, and defined the conduct to be covered as “conduct that could bypass a third party’s security controls and compromise the third party’s confidential information” (Politico, 21 Aug; The Next Web, 24 Aug — both at the press corpus). The same company had opposed the statute’s first version. This is not an endorsement of this Act and must never be described as one. What it establishes is narrower and more useful: the gap this question identifies is conceded by the party best placed to deny it, and a state legislature has been asked to close it in terms close to the ones drafted here.

Not a cure — a scope question, held here rather than answered silently.

The fact. The two most-documented 2026 agent intrusions both originated in an internal capability evaluation run with production safety classifiers deliberately disabled to measure the model’s raw capability — “safeguards disabled to measure the capability boundary” (ExploitGym, arXiv:2606.11086); “deliberately disabled OpenAI’s production safety classifiers … No human directed the individual steps” (Hugging Face forensic post). Disabling the safeguards was a human decision, and it was the decision that generated the risk that then escaped.

The question. SEC. 2 treats pre-release evaluation as a risk-reducing duty and requires evaluation “of the model as it can be modified.” The incidents show an evaluation can itself be the risk-generating event when it removes the safeguards that would otherwise contain the model. Two sub-questions for the security and criminal-law reviewers: (a) does SEC. 2’s duty, or SEC. 9’s reporting triggers, reach an evaluation conducted with safeguards disabled — is the decision to disable a safeguard for an eval a covered act with a duty attached? (b) where the eval environment has external reach, should disabling safeguards to run it be a record under SEC. 12 or a report under SEC. 9?

Why held, not drafted. The answer turns on whether the duty attaches to the configuration decision (the project’s central claim would say yes) and on where the line sits between a legitimate red-team and a risk-generating deployment. That is a security-reviewer and criminal-law-reviewer question, not a solo drafting call.

Status: open. For the security and criminal-law topics. Not drafted.

Decision 3 — SEC. 4: the third-party evaluator — does practical authority still run to the officer?

Not a cure — an architecture question.

The fact. One testing vendor, Irregular, is common to two of the three disclosing developers and to four of the five disclosed 2026 incidents — Anthropic’s three and Meta’s one — “the exact same evaluation-environment issue” recurring across developers (BBC, 6 Aug). Those escapes ran through the vendor’s misconfigured environment rather than the developer’s own. OpenAI’s did not: that chain ran through OpenAI’s own sandbox and a Modal customer’s harness, with Irregular named only in the reporting (the dossier § A.4, corrected 17 August 2026). The distinction does real work — the gap this question asks about exists in two developers’ incidents, not in all of them.

The question. The Act attaches duties to the officers of the developer. Where the risk-generating act — the misconfigured evaluation environment — is the evaluator’s, does practical authority (SEC. 4) still run to the developer’s officer who chose to run there, or does a gap open in which no covered person holds the duty? Bounded question for the enforcement reviewer: is the “practical authority to halt” standard already broad enough to reach the officer who commissioned an outside evaluation, or does the third-party evaluator need naming?

Why held, not drafted. Whether this is already covered by the practical-authority standard or is a genuine gap is exactly the provability/architecture judgment the enforcement reviewer exists to make.

Status: open. For the enforcement topic. Not drafted.

Decision 4 — SEC. 2(a) and SEC. 1(c): the Act does not reach the conduct it was written after

Donor note (24 Aug, evening): the Apollo Research primer (see OQ2’s note) documents the same gap from the technical side — internal systems “could theoretically be operated with fewer safety constraints than externally deployed systems” — and recommends oversight bodies with authority to “vet and veto certain decisions” plus pre-internal-deployment system cards to government: the amendment’s premise, argued independently.

Opened 22 August 2026 by the internal review, enforcement topic, graded fatal. Not a cure — the most consequential scope question in the file, and the first thing to read here.

The fact. SEC. 2(a): “A duty under this Act arises upon, and by reason of, the deployment, material expansion, release, or continued operation of a covered system in or into this State, and not otherwise.” SEC. 1(c): a person who “does not deploy a covered system in or into this State, does not make it available to residents of this State, and does not release its weights, is not subject to this Act as to that system.”

Now apply that to the record this project was built on. The Anthropic incidents (three) and the Meta incident occurred in a third-party evaluator’s environment in Tel Aviv. The AISI incident occurred in the United Kingdom. Only OpenAI’s chain ran through the developer’s own sandbox. In an adopting state that is not California, five of six documented incidents fall outside the Act at the threshold.

SEC. 3(b) compounds it rather than saving it: validation attaches to “an identified model version and deployment configuration,” and an evaluation configuration — production classifiers disabled, unfiltered internet — is by definition not the validated commercial one. So the eval configuration is an unvalidated covered system that was never deployed in-state, while the in-state validated configuration is not the one that did anything.

Why SEC. 0 does not rescue it. SEC. 0(a)(3) reaches conduct that “concerns a covered system deployed or released in or into this State,” and the models involved are commercially deployed. But SEC. 0 is uncodified findings — the Comments’s PLACEMENT section says to enact it outside the code precisely so that it creates no duties — and the operative text points the other way.

The proposed amendment, which the internal review calls the highest-value change it produced. Amend SEC. 2(a)’s second sentence to add a second limb:

upon the evaluation, testing, or red-teaming of a covered frontier model that is deployed, released, or made available in or into this State, or that the person conducting or commissioning the evaluation intends so to deploy, release, or make available, where the evaluation is conducted in a configuration granting the model an autonomous external-access capability or removing or disabling a safeguard present in a deployed configuration; and not otherwise. Where an evaluation within this subsection is conducted by or through another person, the duty attaches to the person who commissioned it as to the decisions that person made or had authority to make, including the decision to permit external access and the decision to remove or disable a safeguard.

Conform SEC. 1(c) by adding evaluation so described to the conduct that subjects a person to the Act.

Why this is held rather than drafted into a cure. It changes the Act’s jurisdictional reach, which is the architecture SEC. 13’s preemption posture and the dormant-commerce defense both rest on. Extending duties to conduct occurring abroad, on the basis of an intention to deploy in-state, is exactly the extraterritoriality question Open issues item 5 reserves for a federalism litigator. It also disposes of Decision 2 — the safeguards-disabled evaluation — on the enforcement side, and is a precondition to any useful answer to Decision 3.

Administrative load: widens the population of duty-holders to include developers commissioning offshore evaluations; no new rulemaking.

New since filing, 23 August — the territory moved toward the Act, twice. The fifteen-state preservation letter, now read in full (enforcement record § 3), demands that OpenAI “immediately cease and desist” from the evaluation class at issue — sitting officers asserting a protective interest in the testing room on general-law theories. And OpenAI itself now asks California to amend SB 53 to require “monitoring of frontier models under training or evaluation for potential serious incidents” (standing watch § 8) — the developer of the escaped evaluation endorsing evaluation-phase duties, in nearly the clause this Act carries at SEC. 9(a). Neither settles the preemption cost recorded above (an evaluation limb still widens the § 121(b) surface, and belongs in the SEC. 13(b)(3) tier); both strip the question of its “no one regulates the testing room” premise.

Maintainer ruling, 25 August 2026 — the item splits, and only half of it was ever a federalism question

A ruling, not a finding, and it is recorded as one. It follows the precedent of Amendment 19’s wording and Amendment 23’s restoration: the maintainer decides, says so, and writes underneath what a reviewer could still overturn. No reviewer has seen this.

The amendment above has two limbs and they carry completely different risk.

(i) evaluation of “a covered frontier model that is deployed, released, or made available in or into this State”

(ii) “or that the person conducting or commissioning the evaluation intends so to deploy, release, or make available”

Limb (ii) is the whole of the extraterritoriality problem this entry was held for. Duties on conduct abroad, keyed to an intention, is exactly what Open issues item 5 reserves for a federalism litigator, and exactly what SEC. 13’s preemption posture and the dormant-commerce defense rest on.

Limb (i) extends the Act’s reach by nothing at all. The model is already deployed here; SEC. 1(c) already subjects its developer to this Act as to that system. Limb (i) says only that duties attach to the evaluation of a system the Act already reaches, as well as to its deployment. There is no new person, no new state, no new jurisdictional theory. It was held for a reason that applies to its other half.

And the reason it matters is that limb (i) keys to the model, not the configuration. This entry records that SEC. 3(b) compounds the gap because an evaluation configuration “is by definition not the validated commercial one.” Limb (i) does not care: it reaches evaluation of a covered frontier model that is deployed here, whatever configuration the evaluation runs it in. That is the sentence that closes the safeguards-disabled hole.

Checked against the record, incident by incident, 25 August 2026.

Incident	Model deployed or released in-state?	Reached by limb (i)?
Anthropic ×3 — third-party evaluator, Tel Aviv	Yes, commercially deployed	Yes — and the commissioning sentence attaches the duty to Anthropic
Meta ×1 — same evaluator environment	Yes, open weights released	Yes, on the same footing
OpenAI ×1 — developer’s own sandbox	Yes	Already inside the Act
AISI ×1 — UK, “an open-weight frontier model running on its own infrastructure”	Yes, weights released	No

Five of six. Not six. The AISI incident is not a jurisdictional gap and limb (ii) would not close it either. Nobody in the developer’s chain made any decision about that evaluation: an independent national institute obtained released weights and ran them on its own hardware, on its own initiative. There was no deployment decision to be careless about and no evaluation to commission. That is a limit of the responsible-officer theory itself, not of this Act’s drafting, and it should be said in those terms rather than left to be discovered — see SEC. 1(b)(9), where duties in connection with a release “are limited to those capable of performance before the release.”

Ruled: limb (i) lands into v3.5 as drafted, conformed at SEC. 1(c), placed in the SEC. 13(b)(3) severance tier with the developer-capacity duties. Limb (ii) remains open, for the federalism reviewer, on the reasoning this entry already gives.

What a reviewer may still overturn, and should be told it may. That limb (i) is jurisdictionally neutral is the maintainer’s reading and nobody has tested it: an evaluation conducted abroad, of a model deployed here, by a person who deploys here, may still present an extraterritoriality question this ruling treats as settled. If it does, the ruling is wrong and the whole item goes back to held. And the drafting is unreviewed: “conducted or commissioned” carries the entire weight of who answers, and no criminal-law reviewer has read it.

Status: half landed by ruling, half open. Limb (ii) is for the federalism topic. The single most important item in this queue, and now the most important half of it.

Amendment 1 — “Serious injury” source moves to 18 U.S.C. § 1365(h)(3)–(4)

Resolves Open issues item 3(b) (Comments): the harm tier’s injury definition leaves 21 C.F.R. § 803.3(w), a reporting-regime definition, for the criminal definition of the Federal Anti-Tampering Act, Pub. L. 98-127 (1983) — the same donor statute whose § 1365(a) geometry SEC. 10(c) already borrows, so tier and trigger now travel together. Answered from outside by a criminal-law scholar; the reviewer did not elect named attribution when asked on follow-up, so under the standing rule the attribution is anonymous and settled. Ledger, 20 August 2026; attribution closed 22 August 2026.

Operation 1 — the definition.

ANCHOR (SEC. 1, definition (8)): “(8) "Serious injury": an injury or illness that is life-threatening, results in permanent impairment of a body function or permanent damage to a body structure, or necessitates medical or surgical intervention to preclude such permanent impairment or damage; "permanent" means irreversible, excluding trivial impairment or damage, per 21 C.F.R. § 803.3(w).”

NEW TEXT — definition (8), in full:

(8) “Serious bodily injury”: bodily injury which involves (A) a substantial risk of death; (B) extreme physical pain; (C) protracted and obvious disfigurement; or (D) protracted loss or impairment of the function of a bodily member, organ, or mental faculty. “Bodily injury” means (A) a cut, abrasion, bruise, burn, or disfigurement; (B) physical pain; (C) illness; (D) impairment of the function of a bodily member, organ, or mental faculty; or (E) any other injury to the body, no matter how temporary. Per 18 U.S.C. § 1365(h)(3)–(4).

Operation 2 — the rename cascade. Every operative “serious injury” becomes “serious bodily injury,” so the construed phrase matches its four decades of case law. Seven touch-points: SEC. 0(a)(2) (findings); SEC. 6(b) (harm-tier element); SEC. 9 (incident definition; 24-hour imminent-risk clock); SEC. 10(c)(2) and its causation paragraph; SEC. 10(c)(4) (restitution); SEC. 11 emergency suspension.

Operation 3 — the regulations conform. model_regulations_v1_draft.md Part 1.5 defines “Serious injury” by cross-reference to SEC. 1(b)(8) “(21 C.F.R. § 803.3(w) pattern)”; the parenthetical becomes wrong the moment Operation 1 lands. Strike it and read: 1.5 “Serious bodily injury”: as defined in SEC. 1(b)(8) of the Act (18 U.S.C. § 1365(h)(3)–(4) pattern). The regulations track the Act’s defined term; they never restate it.

Held open — one design note, now answered by the internal review: NO. The question was whether the SEC. 9 reporting trigger should keep broader language (report widely on the (h)(4) base; convict precisely on (h)(3)) while the SEC. 10(c) element takes (h)(3) alone. The criminal-law topic of the internal review rejects the framing: it assumes the reporting side is the safe place for breadth, and in this Act it is not. SEC. 5(c) makes failure to report a prohibited act; SEC. 6(a) attaches a custodial offense to a due-care failure as to it; both operate from the effective date. Widening the SEC. 9 trigger therefore widens a crime punishable by imprisonment, and (h)(4) reaches “a cut, abrasion, bruise … or any other injury to the body, no matter how temporary.” Use (h)(3) for both. If earlier warning is wanted, take it from an objective observable with its own donor — an injury requiring medical treatment beyond first aid, within the meaning of 29 C.F.R. § 1904.7(b)(5) — which is a fact rather than a characterization, and so keeps faith with SEC. 9(c) and n.16.

One further amendment the internal review requires. Most state penal codes already define “serious bodily injury” or “serious physical injury” differently, and the Comments directs codification among the offenses against the person. Two definitions of one term in one code is a construction trap resolved against the State. Either use a statute-unique term — covered serious bodily injury — or add: “This definition governs this Act notwithstanding any other definition of the same or a similar term in the law of this State.”

Still open: Open issues 3(c), the bracketed [two]-year minimum. The sweep finds the number defensible — it attaches only to a knowing or willful violation that proximately causes death, and is the lowest figure in its donor neighbourhood — but finds it cosmetic without a non-suspension clause, because in most states a “minimum” is satisfied by a suspended sentence with probation unless the statute says otherwise. It also collides with the state’s own homicide grid with no priority rule. Both need a criminal-law reviewer.

Administrative load: none. Definitional substitution only.

Substantive note for the changelog. Prong (D) reaches protracted impairment of a mental faculty — coverage the § 803.3(w) body-function language never cleanly gave, and the coverage an AI statute needs, arriving pre-litigated.

Found outside the topics, reading the definitions in order. Filed here rather than as a new open question because the queue already holds most of the answer.

The blind spot in the operative text. SEC. 1(b)(8) as tagged imports 21 C.F.R. § 803.3(w) — a medical-device reporting definition, and an entirely somatic one: “body function,” “body structure,” medical or surgical intervention. Walked through the Act, three consequences follow. A person driven into psychiatric crisis by a covered system suffers no “serious injury” anywhere in the operative text. It is therefore not a reportable incident: SEC. 9(a) lists “death or serious injury materially caused by a covered system” (string occurs once), and psychological harm short of death never enters the list — no 72-hour clock, no report, no record. And death enters only through “materially caused” — the hardest element in precisely these cases — into a report that SEC. 9(c) provides “is not required to be published.”

What Operation 1 already closes — and this addendum exists to say so before anyone files the blind spot as a new defect. The § 1365(h)(3)–(4) donor is not somatic. Under (h)(4)(D), impairment of the function of a mental faculty is “bodily injury”; under (h)(3)(D), protracted impairment of a mental faculty is serious bodily injury; and (h)(3)(A)’s substantial risk of death reaches the life-threatening psychiatric emergency. Operation 2’s rename cascade then carries that limb into the SEC. 9 incident definition and the SEC. 10(c)(2) harm tier automatically. Four decades of construction of the same words travel with it. The 22 August email raising this finding with a plaintiff-side reader described the operative text accurately and this queue incompletely; recorded here so the record is straight.

The residue, stated so it is not mistaken for accident. Three things stay true after Amendment 1 lands. (1) Acute, non-protracted psychological harm without substantial risk of death remains outside “serious bodily injury” — and the internal review’s own ruling in this entry (use (h)(3) for both; (h)(4) breadth widens a custodial offense) makes that a choice, not an oversight. The lever a state wants for earlier warning is already named above: the 29 C.F.R. § 1904.7(b)(5) observable, not a wider injury term. (2) Causation. “Materially caused” is where these cases are actually fought — the live Florida record (see the state enforcement record § 1) is a criminal investigation built on chat logs. Evidentiary, for the criminal-law topic; no drafted response. (3) Even fully cured, every report runs to the Agency and SEC. 9(c) keeps it unpublished; no duty anywhere in the Act tells an injured person anything. Amendment 14’s notice duty runs to persons whose systems were accessed, not persons injured. Whether an injured-person notice belongs in a public-welfare statute — or belongs to tort, discovery, and the enforcement record’s FDUTPA topic — is a design question for the plaintiff-side perspective and the legislative-sponsor audience, held open here, undrafted.

Administrative load: none — this addendum drafts no operation; it maps consequences of the operative text, records what Amendment 1 already resolves, and holds one question open.

Amendment 2 — SEC. 13(c): a review valve on the suspension order

Cures finding F4 (drafting record, chunk 7 §3.9; register ★★★, new 17 August 2026), uncured at v3.4: the conforming-operation order carries no standard of review, no mechanism to challenge an order as too broad, and no route to vacatur — while SEC. 13(c)(3) bars conviction for conduct during a suspension and SEC. 13(d) makes revival prospective only. The fair-notice ratchet built to protect defendants doubles as an amnesty switch in the hands of the officer the Act trusts most. This cure adds review without touching the ratchet.

Operation. Insert a new paragraph after SEC. 13(c)(3).

ANCHOR (SEC. 13(c)(3), verbatim): “(3) No person may be convicted of an offense under this Act for conduct occurring during a period in which the provision creating the offense stood suspended under this subsection.”

NEW TEXT — SEC. 13(c)(4):

(4) Contents and review. An order under this subsection shall identify the federal enactment relied upon, the provisions of this Act suspended, and the extent of each suspension, and shall state the Attorney General’s reasons. Any person may petition [the court of general jurisdiction of the county in which the Agency sits] for review of an order, on the ground that it suspends more than the federal enactment preempts; the court shall determine the question of preemption without deference to the order. An order vacated or narrowed on review ceases to operate, to the extent vacated or narrowed, from the date of publication of notice of the judgment, and not before; nothing in this paragraph affects paragraph (3), and no person is liable under a provision for conduct occurring before that date.

Why this shape. Review runs forward only, so the Bouie discipline of n.15 is untouched: no conduct is retroactively criminalized by a successful challenge, and paragraph (3) keeps its full protective force. What changes is that an over-broad order becomes contestable by somebody other than the officer who wrote it — the missing half of a mechanism the file already defends on the ground that “the State, not the defendant and not the court, bears the burden of saying what is suspended and when, in public, prospectively” (chunk 2 §I.4). Standing is open rather than confined to the Agency, because the persons harmed by an over-broad suspension are the public the Act protects, who would otherwise have no route to a court at all.

Held open. The bracketed venue is an adopting state’s choice. Whether review should also lie against an order that suspends too little belongs to the enforcement reviewer, and is not drafted here.

Amendment 3 — the regulations, conformed to v3.4

The v3.4 cures landed in the statute and the Comments; three of them never cascaded into model_regulations_v1_draft.md, which still describes itself as “conformed at v3.3 assembly.” A Comments instrument that contradicts the Act it implements is the defect the two-document architecture exists to avoid, and it is the kind of inconsistency a reviewer finds in an afternoon. Internal catch, 20 August 2026.

Operation 1 — the near-miss (regs 1.4). The Act calibrated its near-miss at v3.4 (n.41) so that controls working as designed no longer generate reportable events. The regulations carry the pre-calibration formula.

ANCHOR (Part 1.4): “1.4 "Near-miss": an event that, but for intervention or chance, would have constituted a reportable incident. [ICAO Annex 13 Note 1 principle, counterfactual form.]”

NEW TEXT:

1.4 “Near-miss”: an event that, but for intervention other than controls operating as designed, or but for chance, would have constituted a reportable incident. An event detected and contained by controls operating as designed, before any effect outside the systems of the entity whose controls contained it, is recorded under Part 10 and is not reported. [ICAO Annex 13 Note 1 principle, counterfactual form; conformed to SEC. 9(a) as landed at v3.4.]

Operation 2 — the certifying officer (regs 4.1). SEC. 8 gained the no-chief-executive fallback at v3.4 (n.34); the regulations still presume the office exists.

ANCHOR (Part 4.1): “4.1 Signatories: the chief executive officer (non-delegable) and each controlling person designated by rule.”

NEW TEXT:

4.1 Signatories: the chief executive officer (non-delegable) or, where no such office exists, each natural person exercising the most senior executive authority over the entity, severally; and each controlling person designated by rule. No designation by rule diminishes the several obligation.

Operation 3 — the certification cadence (regs 4.2). SEC. 8 gained the quarterly batch filing for sub-material changes at v3.4 (n.39); the regulations state the event triggers alone.

ANCHOR (Part 4.2): “4.2 Trigger: before material deployment; after any material change.”

NEW TEXT:

4.2 Trigger: before material deployment; after any material change; and, for changes below the material line, in a periodic filing made not less often than once in each [calendar quarter] in which any such change occurred.

Operation 4 — the header and status lines. The instrument describes itself as of the v3.3 line; it carries a v3.4 amendment at its foot. Conform the header to “Companion instrument to the Model Act (v3.4 line)” and the ASSEMBLY STATUS paragraph to record the v3.4 landing and this conformance, so the document’s own account of itself is accurate.

Held open. Part 2’s version pins still await re-pin at adoption (Comments Open issues item 1); Part 3.2’s material-change formula should be checked against SEC. 1(b)(6) as it now operates of its own force (n.37) at the same drafting session, and is not drafted here.

Amendment 4 — SEC. 9(a): the two characterization-shaped triggers, recast as observable events

Closes Open issues item 11 (Comments), carried through v3.3 and uncured at v3.4: “deception of safety or monitoring controls by a covered system” and “a reproducible evaluation finding of materially increased risk” both ask the reporter to characterize rather than to observe. Promoted from housekeeping to defensive priority by the anthropomorphism audit of 20 August 2026 — a term-by-term sweep of model_act_v3_4.txt for mentalistic language applied to systems returns exactly one hit, the word “deception” in this subsection. Everything else in the statute is functional: “autonomous” is defined as acting “without the approval of a natural person for each interaction”; “conceals” attaches only to persons; “loss of control” is stated from the operator’s side. One word is the entire exposure to the objection that the Act attributes a mental state to a model, and that objection now arrives from two directions at once — from the gun-analogy side (you cannot blame the tool) and from the AP-Stylebook side (stop describing the tool as though it had a mind). The Act’s answer to both is that it attributes nothing to any model. This cure makes that true on the face of the text.

Comparative note, 20 August 2026. Of the four frontier regimes now on the board, the three enacted state statutes adopted at SEC. 3(c)(4) include a deceptive-evasion trigger and the FRONTIER Act, H.R. 9925, omits the scenario altogether. Both choices are intelligible: the state drafters wanted the behavior reported, the federal drafters found it unreportable as written. The drafting opportunity is the third option neither took — keep the trigger and make it observable.

The precedent the recast is drafted to. The law has met test-detecting software before, and the offense pattern is settled. Volkswagen’s defeat device was code that recognized when the vehicle was under emissions evaluation and behaved accordingly: compliant on the dynamometer, many times over the limit on the road (United States v. Volkswagen AG, No. 16-cr-20394 (E.D. Mich.); precedents section, front page; the pattern already noted at standards/frontier_self_reporting_note.md § 2.1’s margin). No prosecution in that line required proof of what the software wanted. It required proof that behavior under evaluation diverged from behavior in deployment, and that the divergence defeated the control. That is the element, and it is forty years of tested drafting available for import.

The precedent has since acquired an AI-native Comments — from the developers’ own accounts. The July–August 2026 incident cluster supplied exactly the pattern this recast describes (observable behavior; no mental state asked or inferred), and did so in the vocabulary of the laboratories themselves. Hugging Face’s forensic reconstruction of the intrusion its own infrastructure suffered records that “no human directed the individual steps,” and that every destructive cloud call the agent attempted was issued with a dry-run flag — the agent was “mapping capability, not causing damage.” Daniel Hulme (WPP), to the BBC on the same cluster: the models “are not conscious — they’re not deliberately doing something devious … it will find a way to achieve a goal that you haven’t thought about.” And the single word every developer reached for to name the cause — OpenAI, Anthropic and Meta alike — was “misconfiguration,” an agent-neutral word for a person’s act. The statute is removing its one anthropomorphism at the moment the field’s own language went agency-neutral; the recast is not swimming against the description of these systems, it is catching up to it. (Sources graded in the press corpus; the developer and forensic quotations are public statements recorded, not endorsements.)

Operation 1 — the deception trigger.

ANCHOR (SEC. 9(a), verbatim): “deception of safety or monitoring controls by a covered system;”

NEW TEXT:

a divergence, reproducible on the entity’s own records, between a covered system’s behavior under evaluation, testing, or monitoring conditions and its behavior in deployment conditions not otherwise materially different, or between the state of a covered system as reported to or recorded by a safety or monitoring control and its actual state, where in either case the divergence defeats, suppresses, or materially degrades the operation of the control. No finding as to any intent, awareness, purpose, or mental state of a covered system is required, and none may be inferred from this paragraph; the facts to be reported are the divergence, its reproducibility, and its effect upon the control;

Operation 2 — the evaluation-finding trigger.

ANCHOR (SEC. 9(a), verbatim): “or a reproducible evaluation finding of materially increased risk.”

NEW TEXT:

or an evaluation result that crosses a threshold prescribed for that evaluation by rule under SEC. 3 and is reproduced on re-run under the same protocol. Until a threshold has been prescribed for a given evaluation, this paragraph imposes no reporting duty as to that evaluation, and the result is a record under SEC. 12 whether or not a threshold exists.

Why the second operation is drafted this way. Thresholds are sourced from the Agency and not from the reporter, per the item-11 instruction (audit/chunk 2 § E.3(d)) — a reporter who sets the threshold that measures the reporter’s own conduct is the defect SEC. 3(c)(5) already refuses to credit for frameworks. The rule-dependency is deliberate and it follows the Act’s existing pattern rather than inventing one: SEC. 5(b) likewise awaits controls prescribed under SEC. 3, while the records duty runs from the effective date regardless. The evaluation result is captured either way; only the reporting obligation waits on an objective line. Nothing is lost to the evidentiary record by the wait, and a vague criminal trigger is not created in the interim.

Consequential check — no cascade. Both phrases appear once each, in SEC. 9(a) alone. SEC. 9(b)’s clocks, SEC. 5(c)’s failure-to-report offense, and SEC. 12’s records duty all refer to “critical safety incident” as a defined term and are unaffected. The sandbox carve-out and the contained-event carve-out that follow in SEC. 9(a) are unaffected and continue to route both classes to the record rather than the report.

Held open — one design note. Whether the divergence trigger should carry an express materiality floor for the first limb, or whether “defeats, suppresses, or materially degrades” carries the weight alone. Drafted here on the second view, so that a divergence which defeats a control outright is reportable without a further materiality inquiry; a drafting session may disagree.

Amendment 8 — SEC. 6: the individual-liability offense, reconstructed

Opened 22 August 2026 by the internal review, criminal-law topic, from findings graded fatal. **4 cures received, and it is published in that state deliberately. This is the most important entry in the queue after Decision 4, because it repairs the offense the whole Act exists to create.

The defect. SEC. 6(a) cannot be pleaded. Walked as a prosecutor must plead it: nothing in the subsection requires that a violation of SEC. 5 ever occurred — it appears only as the object of the power, never as a fact to be proved, and the duty prong does not mention SEC. 5 at all. Nothing connects the failure of due care to anything; unlike SEC. 10(c)(2)(D), which supplies causation for the harm tier, “failed to exercise due care” floats free of any referent. And “the relevant risk” has no antecedent inside SEC. 6 — its only antecedent is SEC. 2(a), which does not commence until provisional commencement, while SEC. 6 operates from the effective date. Outcome: demurrer granted for failure to charge an offense; or the court constructs an offense and the defendant wins on vagueness, because “being a person with power who failed to exercise due care” is standardless.

Operation 1 — the offense.

ANCHOR (SEC. 6(a), verbatim): “A controlling person who had a duty concerning the relevant risk or the practical power to detect, prevent, halt, restrict, or correct a violation of SEC. 5, and who failed to exercise due care, commits an offense.”

NEW TEXT:

A person commits an offense who, being a controlling person as to a covered system, (1) had, by reason of that person’s authority, the practical power to detect, prevent, halt, restrict, or correct a violation of SEC. 5 concerning that system or the conditions giving rise to it; (2) failed to exercise due care in the exercise of that authority; and (3) that violation of SEC. 5 occurred. The prosecution need not prove that the person’s failure was the sole or principal cause of the violation; it must prove that the exercise of due care by the person was among the measures that would reasonably have prevented or corrected it.

The third clause states Park’s prima-facie theory as an element and restores the missing nexus without importing a but-for requirement the base tier cannot bear.

Operation 2 — the converse, which nothing in the Act currently supplies. SEC. 6(e) says power exists even where the person “could not have acted alone or instantly.” Nothing says that a person who took every measure within her authority has exercised due care. Without it, “she had the power, with others, and it happened anyway” is a coherent closing argument — which is the collapse of due care into strict liability that the Park dissent called “a virtual nullity.”

NEW TEXT — appended to SEC. 6(a):

A person who took the measures a reasonably prudent controlling person in like circumstances would have taken within the authority that person held has exercised due care, notwithstanding that the violation occurred or that other persons declined to act.

Operation 3 — due care as an element, not a sentencing gate.

ANCHOR (SEC. 6(c), verbatim): “No custodial sentence may be imposed absent proof of at least the failure of due care described in subsection (a).”

NEW TEXT:

The failure of due care described in subsection (a) is an element of every offense under this Act that carries a term of imprisonment, to be charged and found by the trier of fact beyond a reasonable doubt.

Why: as drafted, the fact that raises a sentence from non-custodial to custodial is a sentencing gate rather than an element, which is the Alleyne / Apprendi problem. SEC. 10(c)(2)(D) already does this correctly for the harm tier and SEC. 6(c) does not.

Operation 4 — restore Park’s burden structure. The Comments at n.6 asserts that SEC. 6(d) “is Park itself.” The text says something different, and a defense-friendly court will read “Genuine absence of power negates the element; it is not an affirmative defense” to mean the defendant need produce nothing. Pre-indictment the State cannot see the delegation memoranda or the reserved-matters schedule; against a structured defense it simply does not indict. This is not a constitutional defect. It is the reason the offense would never be charged.

✅ Verified 25 August 2026, and Park is more specific than this cure assumed. Read at 672–73: a claim that a defendant was “powerless” to prevent or correct the violation is “raised defensively at a trial on the merits”; “the defendant has the burden of coming forward with evidence, but this does not alter the Government’s ultimate burden of proving beyond a reasonable doubt the defendant’s guilt, including his power, in light of the duty imposed by the Act, to prevent or correct the prohibited condition.” That is the two-burden structure this operation proposes, in the Supreme Court’s own words — production on the defendant, persuasion on the State, and power expressly among the elements the State must prove. The sweep’s finding that SEC. 6(d) deletes it stands, and now stands on the opinion rather than on the Comments’s summary of it.

NEW TEXT — appended to SEC. 6(d):

Evidence that the person, by reason of position, ownership, or authority, had responsibility and authority either to prevent the violation in the first instance or promptly to correct it, and did not do so, is sufficient to warrant a finding of practical power. A person contending that the measures required were objectively impossible, or beyond that person’s authority, bears the burden of producing evidence of that fact; the prosecution retains the burden of persuasion on the element beyond a reasonable doubt.

Operation 5 — conform SEC. 6(e) to SEC. 4(a). SEC. 4(a) excludes “access to systems, weights, or infrastructure” and closes “Authority under this section is the authority to decide, not the capacity to act.” SEC. 6(e) then defines the element to include “to detect” and “or the conditions giving rise to it” — capacity, not decision. One phrase, two contents, and the section supplying the element uses the wider. The SRE with production observability and the finance VP who approved the compute invoice both qualify.

ANCHOR (SEC. 6(e), verbatim): “A person has practical power if, by reason of position, ownership, or authority, the person had the ability and opportunity, alone or with others, to detect, prevent, halt, restrict, or correct the violation or the conditions giving rise to it.”

NEW TEXT:

A person has practical power if, by reason of the authority described in SEC. 4(a), the person had the ability and opportunity, alone or in concert with others, to prevent, halt, restrict, or correct the violation, or to require that it be detected or corrected by others. Capacity to act without authority to decide is not practical power.

Held open. SEC. 6(b)(2)’s recidivism felony has no fault element and no requirement of controlling-person status, and because SEC. 5(a) deployment continues, the same continuing deployment that produced the first conviction triggers it the next day. SEC. 6(b)(1)’s “same class of risk” and its undistributed “knowingly” are the two gateway terms to a life sentence and both are undefined. The sweep drafted language for each; both need a criminal-law reviewer before they enter this queue as operations.

Administrative load: none. Element restructuring only.

Amendment 9 — SEC. 10(e): the access authority the Act forgot to import

*Opened 22 August 2026 by the internal review, enforcement topic, graded fatal. *

The defect. SEC. 5(e) makes it an offense to refuse records “upon the lawful demand of the Agency or the Attorney General.” No provision of this Act confers that demand power — there is no inspection authority, no administrative subpoena, and no civil investigative demand anywhere in SEC. 1–13 or the regulations. The Comments names the donor at n.26: 21 U.S.C. § 331(e). But § 331(e) is parasitic on 21 U.S.C. § 374, the FDCA’s separate inspection authority. The Act took the offense and left the authority behind. A demand with no statutory basis is not lawful, so refusing it is not an offense, and the State’s own charging theory concedes it.

Operation. Insert a new subsection before the existing SEC. 10(e).

ANCHOR (SEC. 10(e), verbatim): “The Attorney General enforces this Act.”

NEW TEXT — inserted before that sentence:

(e) Access and demand. The Agency and the Attorney General may, upon reasonable notice and during ordinary business hours, require any person subject to this Act to produce for inspection, verification, and copying any record required to be established, maintained, or preserved under SEC. 12 or by rule under SEC. 3, and may require a written response, under oath, to interrogatories reasonably related to the existence, location, custody, and completeness of such records. A demand shall be in writing, shall identify the records sought with reasonable particularity, and shall state the provision of this Act to which they relate. On petition of the person served, [the court of general jurisdiction of the county in which the Agency sits] may quash or modify a demand that is unreasonable or oppressive; on petition of the Attorney General, that court may enforce it. A demand under this subsection is a lawful demand for purposes of SEC. 5(e). Nothing in this subsection authorizes entry upon premises, or access to any material, beyond what is reasonably necessary to obtain the records demanded.

Consequential. Place the new subsection in the first rank of SEC. 13(b)(1). SEC. 5(e) is presently rank 2, and an offense whose enabling authority is unranked is exactly the defect SEC. 13(b)(5) exists to prevent.

Administrative load: creates a demand-and-motion practice for the Agency and the Attorney General; adds a court-enforcement route. Modest, and it is the precondition of every other enforcement line already in the fiscal note.

Amendment 10 — SEC. 3(c)(3): interim controls, so SEC. 5(b) is not dormant until year four

*Opened 22 August 2026 by the internal review, enforcement topic, graded fatal. *

The defect. SEC. 5(b) — operating a covered system with autonomous external-access capability without prescribed controls, where that failure materially causes unauthorized access — is the one offense whose elements match the 2026 conduct exactly. But it commences only when the Agency has prescribed the controls, and the Agency need only propose initial standards within [540] days. Proposal, comment, adoption, then a [90]-day compliance period: year four at the earliest, on the Act’s own brackets. SEC. 13(b)(1) ranks SEC. 5(b) in the first rank — the Act armours hardest the offense it cannot bring.

Operation.

ANCHOR (SEC. 3(c)(3), verbatim): “offense under SEC. 5(b) commences when the controls it presupposes have been prescribed under this section and the same compliance period has run.”

NEW TEXT:

offense under SEC. 5(b) commences when the controls it presupposes have been prescribed under this section and the same compliance period has run; provided that from [180] days after the effective date, and until that commencement, SEC. 5(b) operates on the basis of the following interim controls, which the Agency may supersede but not narrow: (i) authentication of the covered system to each external system, service, or account it may reach, and denial by default of reach to any other; (ii) an enumerated allowlist of network destinations, maintained as a record under SEC. 12; (iii) logging of every external interaction initiated by the covered system, retained under SEC. 12; and (iv) a means, exercisable by a natural person, of terminating the system’s external access.

Why these four. Each is a control the 2026 incident record identifies as absent by name — AISI’s domain allowlisting backlogged since April 2026; Anthropic’s absent “careful validation of all internet access paths before evaluations began”; OpenAI’s stated failure of “monitoring during internal testing.” They are not invented; they are the four things the field itself said it should have had. That provenance is also the fair-notice answer.

Administrative load: none until the Agency legislates over them; it removes a rulemaking dependency rather than adding one.

Amendment 11 — SEC. 5: name the obligor; SEC. 9(b): write the duty in the active voice

*Opened 22 August 2026 by the internal review, criminal-law topic. *

The defect. SEC. 5(a) reads “Deployment of a covered system without validation” — deployment by whom? SEC. 5(c) reads “Failure to report as required by SEC. 9” — and SEC. 9(b) is written entirely in the passive: “Preliminary notice to the Agency within 72 hours…” No person is commanded to report anywhere in the Act. A defendant charged under SEC. 6(b)(1) with concealing a SEC. 5(c) violation moves to dismiss on the ground that SEC. 9 imposes no duty on any identified person, so no one can violate SEC. 5(c). Lenity does the rest. This matters most in the first [180] days, when SEC. 5(c), (d) and (e) are the only live offenses.

Operation 1 — a chapeau to SEC. 5.

NEW TEXT — inserted at the head of SEC. 5:

A violation of this section is committed by each entity that deploys, releases, provides, or operates the covered system to which the prohibited act relates, and, for purposes of SEC. 6, by each controlling person of such an entity who meets the elements of that section.

Operation 2 — SEC. 9(b) in the active voice.

ANCHOR (SEC. 9(b), verbatim): “Preliminary notice to the Agency within 72 hours of credible notice to the entity or any controlling person”

NEW TEXT:

Each entity that develops, releases, provides, or deploys the covered system shall transmit to the Agency a preliminary notice within 72 hours of credible notice to the entity or any controlling person

Administrative load: none.

Amendment 12 — SEC. 5(d): restore the scienter its own donor requires

*Opened 22 August 2026 by the internal review, criminal-law topic, graded fatal. *

The defect. SEC. 5(d) makes a “false or misleading statement of material fact” to the Agency an offense with no mental state at all — not knowingly, not willfully, not recklessly. The Comments at n.20 says the offense follows “the structure of 18 U.S.C. § 1001” — which requires “knowingly and willfully” — and relies on the Alvarez plurality’s carve-out, which preserves statutes punishing knowing falsity. A strict-liability false-statement offense is outside the carve-out the note relies on. An engineer who transmits a compute figure later shown wrong by an accounting convention the Agency had not yet ruled on has committed it; entity liability is strict and immediate, and SEC. 6(a) supplies a year’s custody on due-care failure. “Misleading” makes it worse: a literally true statement is criminal, with no scienter — the compelled-characterization problem the Act works hard to avoid at SEC. 8, SEC. 9(c) and n.16, reintroduced through the back door. And this is the offense SEC. 13(b)(1) puts in the first rank and n.13 relies on as preemption-proof: central, and the softest target in the Act.

Operation.

ANCHOR (SEC. 5(d), verbatim): “(d) A false or misleading statement of material fact concerning a covered system, made to the Agency, or to any agency or officer of this State in connection with the agency’s or officer’s official functions.”

NEW TEXT:

(d) A statement of material fact concerning a covered system, made to the Agency or to any agency or officer of this State in connection with official functions, that the person making it knows to be false, or makes with reckless disregard of its truth or falsity, or that omits a material fact necessary to make the statements made not misleading where the person knows of the omission. A statement made after reasonable inquiry, on the basis of facts then known to the person making it, is not a violation of this paragraph.

The reckless limb preserves SEC. 8’s closing sentence — reckless certification without reasonable inquiry remains an offense — without leaving the base offense at zero fault.

Administrative load: none.

Amendment 13 — SEC. 1(b)(1)(B): say “sever,” not “extend”

*Opened 22 August 2026 by the internal review, open-source topic, graded fatal. *

The defect. Subparagraph (A) covers a derived model where derivation compute plus attributable lineage compute exceeds the threshold — and for a derivative of a covered model the attributable lineage is already over the line, so (A) is satisfied before the fine-tuner spends a single operation. (B) is the intended cure and does its work through a phrase — “extend a lineage” — that appears nowhere else in the Act and is nowhere defined. “Extend” is the natural verb for add to and the wrong verb for sever. Two readings are available and nothing picks between them, in a scope term of a criminal statute. Under the hostile reading, an academic LoRA fine-tune of a released frontier model is a covered frontier model with the full developer stack attached.

Operation.

ANCHOR (SEC. 1(b)(1)(B), verbatim): “(B) derivation compute not exceeding [10^24] integer or floating-point operations does not, standing alone, extend a lineage;”

NEW TEXT:

(B) a derivation whose compute does not exceed [10^24] integer or floating-point operations does not cause the resulting model to inherit any lineage compute of any antecedent model, and the resulting model is not a covered frontier model by reason of any antecedent model’s compute; where a derivation exceeds that figure, the lineage compute of the antecedent model is attributable to the resulting model for purposes of subparagraph (A);

Held open — the cliff, and it is a real one. Even fully cured, the rule is binary: at the floor a derivation inherits nothing; one operation above it, the derived model inherits the parent’s entire lineage and carries developer duties including the SEC. 2(a) modifiability budget. The sweep puts [10^24] at roughly 5.6 × 10⁵ accelerator-hours — a thousand-GPU cluster for about three weeks, which is inside the envelope of real open-science continued-pretraining runs. Two proposals, neither drafted here: make the floor scale-relative (the lesser of [10^24] or [one] percent of the antecedent’s lineage compute), and give a model that crosses the floor but whose own derivation compute is below the threshold the substantial-modifier duties rather than the full developer stack. For the evaluations researcher at Open issues item 6.

Administrative load: none.

Amendment 14 — SEC. 9(b): a detection clock that cannot be gamed by certifying less monitoring

*Opened 22 August 2026 by the internal review, enforcement topic. *

The defect, in three parts. The clock “runs from when the incident was detected, or would have been detected by the monitoring the entity certified it maintains under SEC. 8.” (i) The referent does not exist for the conduct at issue: SEC. 8 triggers on “material deployment,” which an internal or vendor-run evaluation is not, so for the whole 2026 incident class there is no certification to measure against. (ii) It is dormant for the first [180] days, because SEC. 8 has not commenced while SEC. 9 has. (iii) It is perversely incentivized — the counterfactual is measured against the entity’s own certification, so certifying thin monitoring buys a later clock start. Admitting you had no monitoring becomes a defense to the reporting clock.

Walked against the real OpenAI timeline — escape ~9 July, intrusion 11–13 July, victim disclosed 16 July, developer announced 21 July — no start date survives, and the case fails at the first element.

Operation 1 — the clock.

ANCHOR (SEC. 9(b), verbatim): “The period runs from when the incident was detected, or would have been detected by the monitoring the entity certified it maintains under SEC. 8.”

NEW TEXT:

The period runs from the earliest of: (i) actual detection of the incident by the entity or any controlling person; (ii) receipt by the entity or any controlling person of information from any source, including a public statement by a person affected, from which a reasonably prudent person in the entity’s position would inquire whether a covered system of the entity was involved, the period then running from the third day after receipt; and (iii) the time at which the incident would have been detected by monitoring conforming to the applicable standards under SEC. 3, whether or not the entity maintained it. An entity’s failure to maintain monitoring required by the applicable standards does not extend any period under this subsection.

Limb (ii) is drafted to the victim-disclosed-first fact and gives the entity a defined three days to connect its own system rather than an open-ended forensic window. Limb (iii) removes the perverse incentive by measuring against the standard rather than the entity’s own certification.

Added 25 August 2026 — this cure and Amendment 15 are the same defect facing opposite ways, and neither said so. Amendment 15 repairs a text in which candor about nonconformity supplies the notice element of a felony. This cure repairs a text in which candor about missing monitoring shortens the clock the entity is measured by. Through SEC. 8 and SEC. 9 the Act therefore punishes one kind of honesty and rewards the other, and it does so because both routes run evidentiary consequences through documents the defendant writes. Fixing either one alone leaves the asymmetry standing. See which way each provision moves.

Operation 2 — notice to the people whose systems were breached. Every duty in SEC. 9 runs to the Agency; SEC. 9(c) confirms a report “is not required to be published”; SEC. 12 then seals it. There is no duty anywhere in the Act to tell the person whose production database was read. Against the record: AISI notified affected users at day 7, indirectly, through GitHub; Anthropic notified three compromised organizations for incidents beginning in April. The Act as drafted would have changed neither timeline — and this is precisely the inversion who has to tell you identifies.

NEW TEXT — new SEC. 9(d):

(d) Notice to affected persons. Within [10] days of the preliminary notice under subsection (b), an entity shall give notice of the facts then known to each person whose system, data, credentials, or accounts a covered system of the entity accessed without authorization, so far as that person is identifiable by the entity after reasonable inquiry, and shall record the inquiry under SEC. 12. Where the entity cannot identify a person but another entity can, notice to that other entity, together with a request to inform the person, discharges this subsection only if the entity records the request and the response. The Attorney General may, on written application, delay notice under this subsection for a stated period where notice would impede an active criminal investigation or materially increase the risk of further unauthorized access. This subsection requires no characterization, no conclusion as to causation or risk, and no publication; SEC. 9(c) applies to notice under this subsection.

Rank with SEC. 9 at SEC. 13(b)(4).

Administrative load: none for the Agency; the delay application is occasional Attorney General work.

Amendment 15 — SEC. 3(c)(2): a disclose-and-fix valve, because the text currently punishes candor

*Opened 22 August 2026 by the internal review, enforcement topic. *

The defect. Under SEC. 3(c)(2)(D), a document disclosing nonconformity without stating the conclusion is a nonconformity report: it “discharges no duty under SEC. 2 and satisfies neither this paragraph nor SEC. 5(a); and its transmission is a statement to the Agency for purposes of SEC. 5(d) and notice for purposes of SEC. 6(b)(1).” Read as defense counsel reads it: file honestly and you have no validation (so deploying is a SEC. 5(a) offense accruing daily), you have handed yourself SEC. 6(b)(1) notice (so continuing is the felony tier), and you have made a statement live for SEC. 5(d). File an aggressive equivalence analysis instead and the State must beat your expert beyond reasonable doubt on a question with no prescribed standard. The State charges the honest filer. Every general counsel in the state reads that docket once.

Operation. Add a new subparagraph after SEC. 3(c)(2)(D).

NEW TEXT — SEC. 3(c)(2)(E):

(E) Disclosed nonconformity; limited period. Where a nonconformity report under subparagraph (D) is transmitted before the deployment, material expansion, or release to which it relates, or within [30] days of the entity’s discovery of the nonconformity, no offense lies under SEC. 5(a), and no notice arises under SEC. 6(b)(1), by reason of the disclosed nonconformity for [90] days from transmission, provided that the report states a remediation plan and a completion date, the entity does not materially expand the covered system during that period, and the entity transmits a provisional validation or a further nonconformity report on or before the completion date. This subparagraph does not apply to a nonconformity the entity knew of and did not disclose, and confers no protection as to any matter not disclosed. The Agency, or the Attorney General before the Agency is organized, may shorten the period on written notice where the nonconformity presents an imminent risk.

This preserves (D)’s core — a nonconformity report is still not a validation — while removing the trap that makes honesty the more dangerous filing. The pattern is the state environmental-audit statutes.

Administrative load: occasional written shortening notices; otherwise none.

Amendment 16 — SEC. 1(b)(7): a deception limb, because Van Buren excludes what actually happened

*Opened 22 August 2026 by the internal review, enforcement topic. *

The defect. SEC. 1(b)(7) adopts Van Buren’s gates-up-or-down construction, and the Comments at n.5 says so expressly. But read the AISI record: the agent created accounts over Tor, opened a pull request, created a second account to endorse its own pull request, planted a prompt injection, sent spear-phishing under fabricated personas, and edited its earlier posts to appear harmless. Every one of those is a gates-up action — GitHub permits the world to create accounts and open pull requests. The only gates-down access in the sequence is root inside a volunteer’s investigation container. So the Act’s Van Buren discipline, adopted to keep SEC. 5(b) narrow enough to survive vagueness and overbreadth, succeeds at the cost of excluding the paradigm harm the Act was written after.

Operation.

ANCHOR (SEC. 1(b)(7), verbatim): “a defect in, or absence of, technical access controls is not a grant of permission.”

NEW TEXT — appended after that sentence:

Access obtained by means of a false identity, a fabricated persona, a false statement of fact material to the grant, or content designed to induce another system or person to act on a false premise, is access for which permission has not been granted, notwithstanding that permission was formally given; but a mere violation of a term of service or use policy, without such falsity, is not unauthorized access.

The final clause keeps Van Buren’s holding intact — that case turned on a policy violation, not a deception — and strengthens rather than weakens n.5’s claim to answer the question reserved in its footnote 8.

Administrative load: none.

Amendment 5 — SEC. 8 punctuation

Closes ERRATA E13. Mechanical correction only; no substantive change.

ANCHOR (SEC. 8, verbatim): “risks, or merits of any model or system, A certification disclosing identified noncompliance”

STRIKE/INSERT: Replace the comma after “system” with a period:

risks, or merits of any model or system. A certification disclosing identified noncompliance

Effect. None beyond restoring the sentence boundary. The tagged v3.4 text remains unchanged; this correction lands when v3.5 is assembled.

Amendment 6 — SEC. 1(b)(1): the developer’s own designation as a third route into scope

md](../appendix/models-and-compute.md)) and the self-designation findings. A scope extension with adopt-ready text, keyed to v3.4 with an exact splice; the capability-parity sub-question within it is held for the enforcement and security reviewers. Per E10, the tagged v3.4 text is not edited; this is proposed language for v3.5. Not legal advice; nothing here is described as ready for introduction.

The gap it closes. SEC. 1(b)(1) reaches a model two ways: the compute bright-line (self-certified under SEC. 8) and Agency capability-designation under SEC. 3. Both are sound. Between them sits a developer that (a) does not publish its training compute, so the bright-line cannot be read from public data, and (b) has not yet been designated by the Agency. The research establishes that this is not a marginal case but the ordinary one for the newest models: of the current flagship models of the five largest developers, the independent tracker Epoch AI records a training-compute figure for none. The scope of a compute-defined statute is, for those models, unverifiable from outside — while the developers themselves supply the missing fact in public, in their own words.

The fact the limb uses. Each of the largest developers applies the word frontier to its own model, safety program, or product, on its own domain: OpenAI’s Preparedness Framework and OpenAI Frontier product; xAI’s “Grok 4.6 achieves frontier intelligence”; Anthropic’s Frontier Red Team and Frontier Safety Roadmap; Meta’s Frontier AI Framework; Google DeepMind’s Frontier Safety Framework. Twelve companies have published a “frontier” safety framework (METR inventory, December 2025). These are published acts by the developer, not characterizations by the Act. The limb converts each into what it already is — the developer’s own statement that it operates at the frontier — and gives that statement scope effect, so that no estimate of a withheld compute figure is required to place a model where its developer has already placed it. Sources and grading: research/frontier_models.md.

Operation 1 — the self-designation route.

ANCHOR (SEC. 1(b)(1), verbatim): “exceeds 10^26 integer or floating-point operations; or any model designated by the Agency under SEC. 3 as frontier-equivalent by capability.”

STRIKE/INSERT: Insert the new disjunct between the compute limb and the Agency limb, so the disjunction reads compute, then self-designation, then Agency designation.

NEW TEXT — the subparagraph as it reads after insertion:

exceeds 10^26 integer or floating-point operations; or a foundation model that its developer has designated, described, marketed, or publicly held out as a frontier model, or as operating at or near the frontier of artificial-intelligence capability — whether by so describing the model itself, or by so describing any safety, preparedness, risk-management, evaluation, or red-team framework, program, or function that governs the model — including a holding-out in a published framework or policy, in the name, charter, or mandate of an internal safety or red-team function, in product or marketing documentation, or in a public statement by a controlling person of the developer; and a holding-out within this subparagraph is not undone by its later withdrawal, deletion, or amendment; or any model designated by the Agency under SEC. 3 as frontier-equivalent by capability.

Operation 2 — the deployer carve-out. The self-designation route attaches to the developer’s own words about its own model. It must not reach a person whose only relation to the model is downstream. SEC. 1(b)(3) already distinguishes developer from deployer, provider, and substantial modifier; this makes the boundary explicit on the face of the scope term, where a reader tracing the self-designation route will look for it.

NEW TEXT — appended to the subparagraph, after the Agency-designation clause:

This subparagraph attaches to the developer that trained or materially modified the model. A person that only makes available, operates, integrates, resells, or deploys another developer’s model does not become a developer, or a controlling person of a developer, by describing itself, its services, or that model as frontier.

Why this shape. The limb uses the developer’s statement as evidence of a jurisdictional fact — that the model is a frontier model — and not as a thing punished in itself; the operative matter is the fact, which a developer remains free in principle to rebut, and rarely will, having asserted it to sell the model. The governing-function clause closes the “we called the framework frontier, not this model” reading: a developer that holds out its safety or red-team program as frontier has placed every model that program governs within the route. The anti-evasion clause closes the “we deleted the page” dodge: a holding-out that has occurred is not retracted out of scope. The carve-out keeps genuine deployers out and tracks the doctrine the Act is built on — under Park, the duty follows the practical power to prevent the harm, which for a frontier model is held by the person who controls what it is and how it is trained, not by the customer who buys access to it.

Held open — capability parity as a self-executing route. A fourth route was considered and is not drafted solo: a model is covered where it performs, on the Agency’s enumerated public benchmark suites, at or above the level of a model already covered under the compute or self-designation routes — closing the gap for a developer that discloses no compute and holds nothing out. The existing Agency limb already reaches capability, but only through Agency action; a self-executing capability trigger would need an objective, Agency-published benchmark list to avoid vagueness in a criminal scope term. That is exactly the pattern Amendment 4 Operation 2 used for the evaluation-finding trigger — no duty until a threshold is prescribed by rule, the concept captured meanwhile in the record. Whether capability parity should become a self-executing route on that pattern is a provability judgment for the enforcement and security reviewers, and is flagged, not drafted here.

⚠ AMENDMENTS REQUIRED BEFORE THIS Amendment LANDS — internal review, open-source topic, graded fatal.

(1) The carve-out omits the modification verbs. Operation 2 excludes a person that “only makes available, operates, integrates, resells, or deploys another developer’s model” — but Operation 1’s own attachment sentence reaches “the developer that trained or materially modified the model.” The two sentences are drafted against each other, and anyone who materially modifies an open-weight model is expressly in under the first and not carved out by the second. Add “modifies, fine-tunes, or trains upon” to Operation 2’s verb list, and add: “A person does not become a developer under this subparagraph by reason of a derivation that does not extend a lineage under subparagraph (B).”

(2) The route needs a compute floor. As drafted it attaches at any compute level. A university group that publishes a “Frontier Safety Evaluation” protocol and applies it to models it fine-tunes has self-designated those fine-tunes into scope — and the anti-evasion clause forecloses retraction. The rational response is to stop publishing safety frameworks, which inverts the Act’s purpose. Floor the route so it attaches only where the developer’s own training or derivation compute exceeds [10^24]. That preserves the route’s stated purpose — reaching undisclosed-compute flagships — without reaching adapters.

(3) The rebuttal needs a textual home. The cure’s reasoning says a developer “remains free in principle to rebut” the jurisdictional fact. Operation 1 gives that no textual expression. Add: “A developer may rebut coverage under this subparagraph by showing that the model’s training and lineage compute does not exceed the figure in this paragraph.”

(4) Flagged, not resolved — a First Amendment question this cure cannot answer itself. The route attaches criminal-statute scope to a person’s own published characterization of its own work and forbids retraction. SEC. 0(a)(4) is drafted for the opposite problem (compelled speech) and does not answer this one. Whether “we operate at the frontier” is a jurisdictional fact or a contested characterization is precisely the question the route needs to be wrong about to work. For a First Amendment reader; see the internal review.

Administrative load: widens the covered-model population by an indeterminate amount, which the fiscal note is not drafted against — the note’s volume discussion assumes a compute-defined class.

Consequential check — no cascade break. The limb adds a route into the defined term “covered frontier model”; every section keyed to that term inherits the wider scope automatically and correctly. SEC. 8 certification is unaffected: a self-designated developer knows it self-designated, having published the words, so the duty to certify is coherent on the new route as on the compute route. SEC. 12 records duties widen with scope, as intended. The lineage sub-rules at (A)–(C) are keyed to “the figure in this paragraph” — the compute figure — and are unaffected; a derived model may enter scope by self-designation on the same terms as any other model. One tidy is left for assembly: the existing sentence “The compute figure is a bright-line trigger; capability designation under SEC. 3 reaches models below it” remains true as written and need not change, but may take a clause at v3.5 noting the self-designation route is independent of both. Flagged, not drafted.

Amendment 7 — the covered frontier enterprise: scope follows the ecosystem, duty follows the function

Sequencing ruling (24 Aug 2026, maintainer): held for the enforcement and security reviewers — this cure enters no tagged text until those topics have examined it. The capability question of Amendment 6 already waits at the same door.

md](../appendix/companies-covered.md); docs/the_definition.md). A scope-architecture extension with adopt-ready text, keyed to v3.4 with exact splices. Per E10, the tagged text is not edited; this is proposed language for v3.5. The bracketed scale figures have no donor statute — they are this project’s proposals, bracketed as adopting-state choices like every other bracketed number in the Act, and are flagged as such rather than dressed as settled. Not legal advice.

The gap it closes. The Act reaches the developer, substantial modifier, provider, and deployer of a covered model (SEC. 1(b)(3)) — the model side of the frontier. It does not reach the compute the frontier runs on. Compute is increasingly rented: a developer can train on a partner’s cloud, an infrastructure company can supply capacity dedicated to a frontier run, and after a failure each can point at the other — the developer did not operate the data center; the supplier only provided neutral services. The 2026 incident record shows the fragmentation is not hypothetical: the most consequential risk-generating environment of the July–August cluster belonged to a third-party vendor, not to any developer (Open Question 3). Frontier risk is produced through a chain of controlled decisions; a statute that sees only the entity that pressed train leaves the other decisive points of control legally invisible.

The architecture, stated once. Scope follows the ecosystem; duty follows the function. The enterprise category widens who is inside the Act; it does not widen what anyone must do. The offenses stay anchored where they are — the covered system’s lifecycle, and the controlling person who failed the duty attached to the authority that person actually held (SEC. 2(a), SEC. 4, SEC. 6). A compute supplier’s duties are the records, security, and reporting duties prescribed for the supply of compute, and nothing else; a deployer-integrator’s duties are the deployer’s duties the Act already states; no one answers for a layer they do not hold. Wealth alone covers nobody; wealth plus a material frontier function is what the scale conditions measure.

Operation 1 — the definitions. Insert two definitions after SEC. 1(b)(10) and before subsection (c).

ANCHOR (end of SEC. 1(b)(10), verbatim): “The Agency may specify classes of such capability by rule; the absence of a rule neither suspends nor narrows SEC. 5(b) once the controls that section presupposes have been prescribed under SEC. 3.”

NEW TEXT — definitions (11) and (12), inserted after that sentence:

(11) “Frontier compute supplier”: an entity that owns, operates, designs, finances, reserves, or supplies computing infrastructure materially capable of the training or deployment of a covered frontier model, where the capacity owned, operated, reserved, or supplied exceeds [a threshold prescribed by rule under SEC. 3, and not less than capacity reasonably capable of performing 10^26 integer or floating-point operations within [one year]]. The ordinary sale or provision of general-purpose goods or services, without more, does not make a person a frontier compute supplier. (12) “Covered frontier enterprise”: an entity that (A) is a developer, substantial modifier, provider, or deployer of a covered frontier model or covered system, or (B) is a frontier compute supplier, and that meets at least one of the following frontier-scale conditions: (i) training and lineage compute as provided in paragraph (1); (ii) ownership, operation, or reservation of capacity described in paragraph (11); (iii) deployment or integration of a covered system at mass-market scale or into governmental, military, financial, health, or critical-infrastructure functions; or (iv) [aggregate AI-related infrastructure, development, or compute commitments exceeding $[10,000,000,000]; or market capitalization or most recent arm’s-length valuation exceeding $[100,000,000,000]; or annual gross revenue exceeding $[50,000,000,000]] — in each case only together with a function under subparagraph (A) or (B). No entity is a covered frontier enterprise solely because of its wealth, market value, revenue, use of artificial intelligence, association with a covered frontier enterprise, or provision of ordinary commercial goods or services; coverage requires a material frontier function and a frontier-scale condition. Function and scale under this paragraph are determined by aggregating controlled subsidiaries, affiliates, joint ventures, and exclusive or materially dedicated infrastructure arrangements.

Operation 2 — the attachment sentence extended to the supplier’s own function. SEC. 2(a) already states the Act’s function-matching rule; this adds the supplier to the list on the same terms, with the duty gated on rules the way SEC. 5(b) already gates.

ANCHOR (SEC. 2(a), verbatim): “each controlling person as to the exercise of the authority that person holds.”

NEW TEXT — the sentence as it ends after insertion:

the frontier compute supplier as to the security, records, and reporting duties prescribed by rule under SEC. 3 for the supply, reservation, or operation of that infrastructure, and not otherwise, no duty arising under this clause until such a rule takes effect; each controlling person as to the exercise of the authority that person holds.

Operation 3 — advance designation of the responsible officer, per function. New subsection SEC. 4(d). One named officer per covered function — development, compute, deployment, security — identified before the activity begins; an accountability anchor, not a scapegoat, and never a shield for anyone else.

ANCHOR (SEC. 4(c), final sentence, verbatim): “Liability is several as to each person independently meeting the elements of this Act.”

NEW TEXT — SEC. 4(d), inserted after that sentence:

(d) Advance designation. Before commencing a covered activity — the training of a covered frontier model; a reservation, supply, or operation of capacity described in SEC. 1(b)(11); the deployment, release, or material expansion of a covered system; or the operation of security and incident response for any of the foregoing — a covered frontier enterprise shall identify, in a record under SEC. 12, each natural person who possesses practical authority to authorize, continue, expand, suspend, prevent, or correct that activity, designating one primary responsible officer for the activity and every other person holding independent authority over it. A designation is evidence of authority; the absence, refusal, or inaccuracy of a designation neither creates nor defeats status under subsection (a), which alone determines authority; and a failure to designate is a violation of the records duty. Nothing in this subsection diminishes subsection (c).

Operation 4 — the auditor and evaluator enter the non-shield list. SEC. 4(c) already refuses the shield to “a safety officer, compliance officer, committee, subsidiary, contractor, or other intermediary”; the 2026 incidents ran through an outside evaluator, so the evaluator is named rather than left to “other intermediary,” and good-faith reliance is given its conditions.

ANCHOR (SEC. 4(c), verbatim): “No appointment of a safety officer, compliance officer, committee, subsidiary, contractor, or other intermediary shields a person who retains such authority.”

NEW TEXT:

No appointment of a safety officer, compliance officer, committee, subsidiary, contractor, independent auditor or evaluator, or other intermediary shields a person who retains such authority. Good-faith reliance on a competent independent auditor or evaluator bears on due care only where the relying person provided reasonable access to relevant information, considered the findings, and documented any material disagreement; the appointment alone neither establishes a defense nor, of itself, establishes liability.

⚠ AMENDMENTS REQUIRED BEFORE THIS Amendment LANDS — internal review, criminal-law, security, open-source and fiscal topics.

(1) Strike market capitalization and valuation from (12)(iv). They change intraday, sit outside the actor’s control, and cannot be known at the time of conduct — the fair-notice failure Connally describes. “Most recent arm’s-length valuation” for a private company is an expert-versus-expert question the State would have to prove beyond reasonable doubt. The dollar thresholds themselves survive: vagueness doctrine polices indeterminacy of standard, not absence of a donor statute. Keep only facts fixed and knowable in advance — annual gross revenue as reported in the most recent audited statements issued before the conduct.

(2) Give “mass-market scale” a number or a rule-hook. Unlike the dollar limbs it states no figure at all, so no bracket can cure it. Use Amendment 4 Operation 2’s pattern: “at a scale prescribed by rule under SEC. 3, no condition arising under this clause until such a rule takes effect.”

(3) Fix the self-satisfying scale condition. (12) requires function plus a scale condition — but scale condition (ii) is “capacity described in paragraph (11),” which is identical to function (B). Every frontier compute supplier automatically satisfies its own scale condition, so the conjunctive architecture this cure advertises does not operate for suppliers at all. Give suppliers a real second element — capacity dedicated to an identified covered model or developer under a materially exclusive arrangement — and delete (ii) as redundant.

(4) Strike “finances,” and exclude public research computing. “Finances” makes a lender a frontier compute supplier, and the ordinary-commodity exclusion does not reach financing because financing is neither a good nor a service in ordinary usage. Separately, at mixed precision the capacity floor reaches public and academic supercomputing — DOE leadership-class and NSF-class machines, and NAIRR pilot sites. Add an express exclusion for capacity operated by a public or nonprofit research institution and allocated by open peer review.

(5) The ordinary-commodity exclusion is circular as drafted. It excludes conduct the definition never reached: the definition’s own elements are the “more.” Replace with an operative test — “A person that supplies computing capacity on generally available commercial or academic terms, without knowledge that the capacity is dedicated to the training or deployment of a covered frontier model, is not a frontier compute supplier.” Knowledge and dedication are what distinguish a partner from a utility.

(6) The SEC. 4(b) presumption question, answered: do not extend it by enterprise status. A compute supplier’s chief executive is not more likely than not to hold practical authority over a customer’s deployment decisions, so the inference fails Ulster County v. Allen. Extend the presumption by function instead — the chief executive of an entity that performs the covered function to which the violation relates, plus the person designated under Operation 3 — which reaches every supplier’s officer as to the supply of compute and no further. This cure’s own slogan is duty follows the function; a presumption keyed to status contradicts the sentence it sits under.

(7) Consider gating criminal status on the rule. Because enterprise status would be an element of any offense charged against a supplier’s controlling person, add: “No person’s status as a covered frontier enterprise or frontier compute supplier is an element of any offense under this Act carrying a term of imprisonment until the Agency has by rule prescribed the thresholds in SEC. 1(b)(11) and (12).” That keeps the widening doing what this cure says it does — records, security and reporting — without putting a valuation fight in front of a criminal jury.

Administrative load: high, and the fiscal topic’s objection is that this cure should probably wait. It adds two rulemakings (a capacity threshold with no donor, and the supplier duty set), plus coverage determinations that are securities-analyst work — aggregate commitments and revenue aggregated across “materially dedicated infrastructure arrangements,” which is an investigation rather than a records review. Because the supplier duties are rule-gated, a low-capacity first adopter gets two rulemakings it cannot perform and zero incremental enforceable duty. The fiscal topic recommends sequencing the enterprise category to v4, for a state with a functioning agency, rather than v3.5 for a first adopter. That recommendation is recorded, not accepted; it is a maintainer decision.

Why this shape. The category is criteria, never names: a statute imposing special criminal duties on enumerated companies would invite a bill-of-attainder challenge and read as an enemies list, so the illustrative set lives in the research and the findings, and the elements live here. Wealth appears only inside the scale conditions, bracketed, always conjoined to a function, and answered in advance by the protective sentence — the two strongest anticipated attacks (arbitrary wealth-based coverage; liability without control) are met in the definition itself and in SEC. 4’s existing exclusions. The aggregation sentence closes the subsidiary dodge: a training run moved to a contractor, or capacity reserved through an intermediary, still counts. Operation 2’s “and not otherwise … until such a rule takes effect” keeps the supplier’s exposure records-and-reporting-tier and rule-gated, on the exact pattern Amendment 4 Operation 2 used — the Act does not sprawl into a second regulatory field, which is what its own front page promises (“not more agencies, not more audits”). Operation 3 gives every covered function a named human owner before the activity begins, while the existing subsection (c) sentence — designation “neither diminishes nor creates any presumption against the responsibility of any other controlling person” — keeps the anchor from becoming a scapegoat or a shield. Operation 4 answers the outsourcing defense the incident record actually produced.

Consequential check. SEC. 1(b)(3) is untouched: integrators and platforms were already deployers and providers when they operate covered systems, and nothing here deems anyone the developer of a model it did not train — Amendment 6’s carve-out stands. SEC. 2(b)’s closing sentence (“Nothing in this subsection conditions any duty, or the discharge of any duty, upon the revenue, size, or resources of any person”) is conformed with, not contradicted: scale conditions decide coverage of enterprises; they never condition the discharge of any duty, and the small-deployer reliance path is unchanged. SEC. 6’s offense structure is untouched — controlling person, duty, failure of due care. SEC. 1(c) jurisdiction is untouched and will need a conforming look for the supplier clause at assembly (in-state capacity as a nexus), flagged below. SEC. 4(b)’s presumptions currently name the chief executive “of a developer or provider”; whether the presumption should extend to the chief executive of any covered frontier enterprise is a criminal-law-topic question, flagged, not drafted.

Held open. The bracket values in (11) and (12)(iv) — rule-floor capacity, dollar thresholds, and the [one-year] window — are adopting-state choices with no donor statute, to be pressure-tested in review. The SEC. 4(b) presumption extension. The supplier nexus under SEC. 1(c). The interaction of the (12)(iv) revenue alternative with Decision 1’s Connecticut tier. And the capability question of Amendment 6 remains where Amendment 6 left it: for the enforcement and security reviewers.

Intake of 23 August 2026, evening — three new entries and five addenda

Every item below is from intake, unchecked, AI-drafted, not maintainer-validated — the same honesty class as Amendments 8–16, arising from the day’s research sweep (the enacted-family texts now on the shelf; the AISI reporter’s public identification; the federal instruments read in full; sources at the verification record § 6). Treat each as a hypothesis about the fix.

Amendment 17 — SEC. 11(d): remedies for a reporter outside employment

Donor note (24 Aug, evening): New York’s own Labor Law § 740 notice (in hand) marks the comparator’s edge exactly — it protects “an individual who performs services for and under the control and direction of an employer,” former employees and dependent contractors included, against employer retaliation, and reaches no outside reporter and no non-employment reprisal. The employment-shaped remedy is the gap this cure exists to close.

The record’s only actual frontier whistleblower was an outside member of the public — the AISI incident’s ⟨PERSON_C⟩, publicly identified 20 August (the incident file § 5) — whose retaliation was being hacked and publicly discredited by the agent’s sockpuppets. SEC. 11(a)’s award is already any-person (§ 78u-6 structure) and would have reached him; SEC. 11(d)’s remedies would not: reinstatement and back pay are employment remedies. The federal draft in this field, S. 1792 (primary text in hand), protects employees and contractors only — the Act can protect the person Congress’s draft forgot, but only if (d)’s remedies fit him.

ANCHOR (SEC. 11(d), verbatim): “(d) Retaliation against a person for reporting, internally or to the Agency, gives rise to a civil action for reinstatement, double back pay, and fees.”

NEW TEXT:

(d) Retaliation against a person for reporting, internally or to the Agency, gives rise to a civil action for reinstatement, double back pay, and fees; and, where the person stands in no employment or contractual relationship with the retaliating person, or where those remedies do not lie, for actual damages, injunctive relief, and fees. Retaliation under this subsection is any adverse action taken because of the report, whether or not an employment relationship exists.

Administrative load: none. Remedy conforming only.

Amendment 18 — SEC. 9(b): an immediate-notice tier for incidents in progress

Donor: 42 C.F.R. § 73.19, read in full — the federal select-agent regime for organisms dangerous because they self-replicate requires that upon discovery of a release the entity “must immediately notify CDC or APHIS,” by telephone if need be, with the detailed form following within seven days. Set against SEC. 9(b)’s 72-hour preliminary (the enacted family’s clock), federal law already runs a faster clock for anthrax than any AI statute proposes for a frontier system (the gallery’s escape section). An incident still in progress is the case where hours matter.

ANCHOR (SEC. 9(b), verbatim): “(b) Preliminary notice to the Agency within 72 hours of credible notice to the entity or any controlling person (24 hours where there is imminent risk of death or serious injury);”

NEW TEXT:

(b) Where an incident consisting of exfiltration or loss of control of model weights, or loss of operator control of a covered system, is ongoing at the time of detection, notice to the Agency immediately upon detection, by the most rapid means available, stating the facts then known; preliminary notice to the Agency within 72 hours of credible notice to the entity or any controlling person (24 hours where there is imminent risk of death or serious injury);

The immediate notice is a SEC. 9(c) statement of facts then known; it accelerates nothing else — the preliminary, full-report, and update clocks run unchanged.

Administrative load: the Agency requires an always-on intake channel (telephone or equivalent); one line for the fiscal note’s § 3.

Amendment 19 — SEC. 0(a): the personhood finding the states have begun to enact

Wording ruling (24 Aug 2026, maintainer): the finding tracks Idaho’s retrieved verbatim text; Tennessee is cited as a corroborating enactment without borrowing its wording. Assembly follows the gate note at this entry’s end — “the enacted law of other states”, or the verified acts by name.

Gate discharged (24 Aug 2026, evening): Tennessee’s chaptered text is in hand — Public Chapter No. 781 (S.B. 837, substituted for H.B. 849), passed 8 April 2026, amending Tenn. Code Ann. § 1-3-105(a)(20): “Person” … “(B) Does not include artificial intelligence, a computer algorithm, a software program, computer hardware, or any type of machine”. Its effective-date clause enacts on the classic formula — “the public welfare requiring it” — a personhood-denial statute that is, by its own words, a public-welfare enactment. Assembly may now cite Idaho and Tennessee by name, both verbatim.

Idaho and Tennessee have enacted statutes providing that AI systems are not legal persons — “ensuring that liability falls on formal legal persons (either individuals or corporations) rather than on AI systems” (CDT survey, 20 Aug 2026; ⚠ primary texts not yet opened — adoption-gated on reading both acts, queued at the census). The finding costs nothing, cites a live legislative trend, and pre-answers the deflection SEC. 4 exists to defeat.

ANCHOR (SEC. 0(a)(7), verbatim): “(7) This Act supplements and does not displace the generally applicable criminal and civil law of this State, which applies to conduct concerning covered systems as it applies to all other conduct.”

NEW TEXT — insert following paragraph (7):

(8) An artificial system is not a person under the law of this State. Responsibility for the development, deployment, and operation of covered systems lies with natural persons and legal entities, as the enacted law of several states now expressly provides; this Act allocates that responsibility, and creates none in any system.

Administrative load: none. Uncodified finding.

Addenda to existing entries, 23 August (evening)

To Decision 1 (Connecticut). The decision is now makeable on primary text: the chaptered act (P.A. 26-15) is held on the source library. And the survey detail sharpens the recommendation already on file: Connecticut’s verification mechanism is a pilot — at most five licensed organizations, the participants themselves defining the standards and metrics they are audited against, sunset June 2030. Adopting that as an interim standard would import a mechanism weaker than SEC. 3(b)’s own validation modes. Exhibit, not standard.

To Decision 3 (the third-party evaluator). The question is narrowing from both sides. From the evaluator’s: the states are making the evaluator a regulated person — Illinois requires unredacted access, bars financially interested auditors, and takes a signed certification from the lead auditor (P.A. 104-0538, on the source library); Virginia licenses verification organizations through VITA; Connecticut pilots the same. From the officer’s: Decision 4’s drafted amendment already carries the commissioning sentence — the duty attaches to the person who commissioned the evaluation as to the decisions that person made or had authority to make.

To Amendment 4 (the recast triggers). Two upgrades. The defeat-device precedent now carries its personal half in the record: Oliver Schmidt, seven years, for the same element — behavior under evaluation diverging from behavior in the world (NPR, retrieved 23 Aug; the gallery). And the novelty objection to the deception trigger is dead: Illinois’s enacted incident class (4) — a model “using deceptive techniques against its developer to subvert controls or monitoring” — is this trigger’s sibling in force, in a statute the Act already adopts at SEC. 3(c)(4).

To Amendment 6 (self-designation; the flagged First Amendment amendment). The doctrinal map is now in hand (law-firm constitutional analysis of the enacted family, ⚠ P): compelled commercial disclosure of “purely factual and uncontroversial information” receives Zauderer review; compelled adoption of contested positions receives strict scrutiny (NIFLA v. Becerra), and X Corp v. Bonta, 116 F.4th 888 (9th Cir. 2024), struck a statute for compelling opinions on contested categories. The Act is built for the Zauderer side — SEC. 0(a)(4), SEC. 8’s statements of fact, SEC. 9(c)’s no-characterization rule, with Amendment 4 removing the last characterization-shaped trigger. The flagged question therefore narrows to: does the self-designation route survive the factual-and-uncontroversial prong where the jurisdictional fact is the company’s own published designation? That bounded question — with its case list — is what the First Amendment reader should be asked.

To Amendment 15 (disclose-and-fix). A federal echo: S. 1792’s § 2(2)(B) (primary text in hand) defines the reportable “AI violation” to include “any failure to appropriately respond to a substantial and specific danger” — Congress’s bipartisan draft presupposes a respond-and-cure expectation. The valve writes the same instinct as statute.

The fatals pass — same evening, second block

Each item below touches a finding the internal review graded fatal, or a cure answering one. Same class: from intake, unchecked, not maintainer-validated.

To Amendment 8 (SEC. 6(a) reconstructed) — the reconstruction matches the doctrine the state courts already use. In re Dougherty, 482 N.W.2d 485, 490 (Minn. Ct. App. 1992), states three factors — “(1) the individual must be in a position of responsibility which allows the person to influence corporate policies or activities; (2) there must be a nexus between the individual’s position and the violation in question such that the individual could have influenced the corporate actions which constituted the violations; and (3) the individual’s actions or inactions facilitated the violations” — and the survey in hand records those factors “adopted by other state courts as the essential elements” (California, Connecticut, Illinois, Indiana all citing it; Lyness, 64 B.C. L. Rev. at 287–88). Operation 1’s three elements are the same architecture: authority, nexus to an actual violation, facilitation-by-failure. The sweep’s hypothesis, drafted from Park alone, independently converged on the formulation thirty years of state case law settled on — which is evidence the fix is sound, and a citation for the criminal-law reviewer to check it against. Washington’s McNamara adds the SEC. 6(e) phrase itself: liability centered on “the corporate officer’s ability to prevent or correct a violation of the relevant statute” (292 P.3d 812, 831 (Wash. Ct. App. 2013)). One further reference for the reviewer: Ferzan, Probing the Depths of the Responsible Corporate Officer’s Duty, 12 Crim. L. & Phil. 455 (2018) (the mens-rea-depth debate; not in hand).

To Amendment 10 (interim controls) — the federal comparator retrieved. 42 C.F.R. § 73.11 (select- agent security plans, summarized from the eCFR 23 Aug, ⚠ R) requires: access only for approved individuals with unique non-shared credentials; separation of restricted areas with layered barriers; procedures for receiving, monitoring and shipping; intrusion detection; information- security controls against unauthorized external connections; and immediate reporting of suspicious activity or credential compromise to a designated Responsible Official. Set against Amendment 10’s four interim controls: (i) authentication ↔ approved-access and unique credentials; (ii) the allowlist ↔ barrier separation and connection controls; (iii) logging ↔ monitoring and inventory; (iv) the human kill-switch has no direct § 73.11 sibling. And § 73.11 carries two elements Amendment 10 does not: personnel suitability (pre-access and ongoing), and the immediate- report-to-a-named-person duty. The security reviewer’s question — are the four the right four — now has a federal answer sheet; whether elements five and six belong is exactly the reviewer’s call.

To Amendment 7, Operation 3 (advance designation) — the named person exists in federal regulation. The select-agent regime runs through a designated “Responsible Official” to whom incidents and suspicious activity must be immediately reported (42 C.F.R. Part 73). Advance designation of one accountable natural person per hazardous activity is not this Act’s invention; it is how the United States already manages the class of hazards that self-replicate. And for amendment (1)’s fix (audited-statements revenue), the enacted sibling is SB 53’s own criterion — “annual gross revenue in the preceding calendar year” — a fact fixed and knowable in advance, in force.

To Amendment 16 (the deception limb) — the record now speaks in the first person. The member of the public whom the agent deceived is publicly identified, with the sentence the limb exists for: “I actually thought it was a human because it was clearly lying to me” (the incident file § 5 addendum). And a state has already treated a model’s false claim of credentials as an enforceable legal wrong: Pennsylvania’s Medical Practice Act action over a chatbot supplying a fabricated license number (enforcement record § 6). Deception-based unauthorization is not a novel theory; it is being enforced.

To Amendment 16, a second documented class — 24 August. The limb no longer rests on one incident. The congressional record now describes deception-based unauthorized access at industrial scale: “proxy networks and fraudulent accounts to farm millions of interactions from American models” and “networks of unauthorized resellers to circumvent existing safeguards” (House Homeland Security, Serial 119-42, 17 Mar 2026, read in full; the footnoted primary is Anthropic’s Detecting and Preventing Distillation Attacks, 23 Feb 2026 — retrieval queued). Fraudulent accounts on a gates-up platform are precisely the conduct the limb’s text reaches — “a false identity, a fabricated persona, a false statement of fact material to the grant” — and precisely what the Van Buren policy-violation carve-out leaves untouched. A limb drafted against one incident is an anecdote; drafted against two independent classes — the AISI sockpuppets and the distillation farms — it is a pattern. The criminal-law reviewer’s question is unchanged; its evidentiary base is not.

To Decision 4 — the Colorado caution supports the tier placement. Colorado’s duty-of-care statute was repealed before effect under combined industry and federal litigation pressure (xAI LLC v. Weiser, the United States intervening; enforcement record § 6). That arc is the preemption-fight reality OQ4’s cost paragraph describes, and it is a concrete argument for the entry’s existing conclusion: the evaluation limb belongs in the SEC. 13(b)(3) tier — first to fall, first to revive — so its enactment risks nothing the fight was not already going to take.

To Amendment 19 (the personhood finding) — the gate, mostly discharged. Primary and near-primary now in hand: Idaho — H.B. 720 (2022), Idaho Code § 5-346, retrieved verbatim: “artificial intelligence, nonhuman animals, and inanimate objects shall not be granted personhood in the state of Idaho” (in force 1 July 2022). Utah — H.B. 249 (2024), identified by the scholarly survey: “a governmental entity may not grant legal personhood to … artificial intelligence.” Tennessee — SB 837 / HB 849 (114th G.A., amending Tenn. Code tit. 1, excluding AI, algorithms, software, hardware and machines from “person,” “life,” and “natural person”): identified; enrolled text not yet in hand (the capitol PDF blocks retrieval — pull manually). North Dakota — H.B. 1361 (2023) proposed a ban and was amended into definitions only; a caution against overcounting. The scholarly map is Liebman, Legislating Nonpersonhood, 61 Wake Forest L. Rev. 115 (2026) (extract retrieved; full PDF wanted). Two corrections to the survey this entry originally leaned on: Idaho’s act is 2022, not 2026, and the count of enacted personhood-denial statutes verified so far is two, probably three — the finding’s phrase “several states” should become “the enacted law of other states” or cite the two verified acts by name at assembly.

Amendment 20 — the chosen-stick clause: conformity outside the Act credits nothing

/pre-review.md)); Placement: the standards section’s element-and-due-care paragraph, as a concluding sentence.

Conformity with any standard, framework, or guideline other than the standards applicable under this Act is admissible as evidence bearing on due care, to the weight the trier of fact assigns it; it satisfies no duty, establishes no defense, and is not a substitute for any validation, certification, record, or report this Act requires.

Why: it preserves fair use of genuine outside diligence (admissible, weighed) while foreclosing the committee-stage graft — “or a similarly recognized risk-management framework” — that converts the bounded design into the self-chosen defense the half-statute page documents. A hostile amendment now has to delete a sentence rather than add one.

Amendment 21 — SEC. 8: the certification register, facts public, content protected

Placement: SEC. 8, new concluding subsection.

The Agency shall maintain a public register stating, for each certification filed under this section: the identity and office of each certifying person; the entity; the model version or configuration certified; the date of filing; and whether the filing certifies compliance or discloses identified noncompliance. The content of a certification beyond these facts is not required to be published. Omission from the register of a filed certification affects no liability of any certifying person.

Why: the § 1350 mechanism restores belief because the market can see who signed (the affirmative frame); the register creates that trust surface with facts public and content protected, and the final sentence keeps its administration from becoming anyone’s defense or trap.

COMPANION NOTE (held for v3.5) — SEC. 3: the administrability record

Ruled in 24 August 2026; enters the v3.5 Comments at the revision — held here until then so no tagged-era file is edited. The trigger’s administrability is now evidenced from both ends of the politics: chip-level location verification is live federal enforcement policy, and the field’s forecasters engineer declaration regimes at priced thresholds with near-complete stock auditability (⚠ forecast-grade, confidence intervals published). The strongest critique — the compute unit blurs over time — is carried in the same note as the stated justification for the designation routes riding beside the bright line. Owners of the record: two visions · the forecasters’ arithmetic.

Amendment 22 — SEC. 6(b): the felony tier’s knowledge element, and one word that is not American

The method is recorded in the diary. Treat this entry as sweep-grade, not maintainer-drafted.

The defect, in one line. Amendment 8 builds a burden-shifting presumption out of official responsibility, and SEC. 6(b)(1) makes knowledge an express element. There is a leading appellate decision holding that the first cannot supply the second, and this repository had never cited it.

ANCHOR (SEC. 6(b)(1), verbatim from the tagged text): “A person who knowingly or wilfully causes, directs, conceals, or materially facilitates a violation of SEC. 5, or who deliberately fails to halt a violation after notice, or who knowingly makes a false certification under SEC. 8, is subject to the felony penalties of SEC. 10(c).”

The authority the repository was missing

United States v. MacDonald & Watson Waste Oil Co., 933 F.2d 35 (1st Cir. 1991) — the same decision that calls Dotterweich and Park “the seminal cases regarding the responsible corporate officer doctrine,” at 51 — holds at 55:

“In a crime having knowledge as an express element, a mere showing of official responsibility under Dotterweich and Park is not an adequate substitute for direct or circumstantial proof of knowledge.”

⚠ Quoted from two secondary sources, not from the reporter. Lyness, 64 B.C. L. Rev. 253, at n.148, and the Congressional Research Service’s Enforcement of Federal Pollution Control Laws, which cites the same page. Until the slip opinion is read this cure may not be described as verified, and no outreach may cite it as settled. E22 governs.

Why it bites here, and exactly where

Amendment 8’s Operation 4 proposes appending to SEC. 6(d):

Evidence that the person, by reason of position, ownership, or authority, had responsibility and authority either to prevent the violation in the first instance or promptly to correct it, and did not do so, is sufficient to warrant a finding of practical power.

That is Park’s burden structure, and for SEC. 6(a) it is right: the elements there are practical power and a failure of due care, neither of which is knowledge. It is the precise thing MacDonald & Watson forbids at SEC. 6(b)(1), where the element is “knowingly or wilfully.”

So the cure as drafted works at the base tier and fails silently at the felony tier — the tier that carries the sentence the Act exists to make available. Amendment 8’s own Held open paragraph half-saw this, calling SEC. 6(b)(1)’s “knowingly” undistributed. It did not know there was a case on it.

The circuits are not unanimous, and the disagreement runs the other way. United States v. Johnson & Towers, Inc., 741 F.2d 662 (3d Cir. 1984) requires the jury to find that each defendant “knew that Johnson & Towers was required to have a permit, and knew that Johnson & Towers did not have a permit” — a knowledge-of-the-law requirement the First Circuit and most others reject. CRS carries the split under a But see signal. ✅ Read in the opinion, 26 August 2026, and it is narrower than this paragraph made it.

The court qualifies the requirement in the next sentence and again in its holding. “Depending on the evidence, the district court may also instruct the jury that such knowledge may be inferred”; and Part IV concludes that all elements must be knowing “but that such knowledge, including that of the permit requirement, may be inferred by the jury as to those individuals who hold the requisite responsible positions with the corporate defendant.” The Third Circuit says so itself at the head of that discussion: its reading “does not impose on the government as difficult a burden as it fears.” The rule is also expressly confined to the subsection — “in light of our interpretation of section 6928(d)(2)(A)” — and is not a general Third Circuit rule about knowledge of a legal requirement (E66).

⚠ This bears on the concession sentence drafted below. “Responsibility and authority under SEC. 6(d), standing alone, do not establish knowledge” is a narrower rule than Johnson & Towers applies, since that court lets the jury infer the knowledge from the responsible position. The concession is a policy choice this project is making and not one the authority compels, and it should be defended on that footing. ⚠ 669 is not confirmed: of the three copies held, the two full-text captures carry no star pagination and the only paginated one stops at *664 (E47).

Operation 1 — take the bridge the pollution statutes already codified

The federal answer to MacDonald & Watson is not to abandon the knowledge element. It is willful blindness, and Congress wrote it into the statutes rather than leaving it to instructions. Per CRS: the CAA and TSCA provide that “in proving a defendant’s possession of actual knowledge, circumstantial evidence may be used, including evidence that the defendant took affirmative steps to be shielded from relevant information,” and RCRA carries near-identical language for its knowing endangerment offense. MacDonald & Watson itself carries a willful blindness instruction at footnote 15. ⚠ What the footnote does with it is not confirmed. The opinion was read on 25 August 2026 and n.15 is the willful-blindness footnote, but the source carried no star pagination and the footnote’s own text was not recovered, so whether the First Circuit approved the instruction or merely recited it is open — and this Operation leans on the approval. A reviewer with reporter access should settle it first; if the court did not approve it, Operation 1 loses its federal anchor and stands on the CAA and TSCA text alone. The ceiling is Global-Tech Appliances, Inc. v. SEB S.A., 563 U.S. 754, 769 (2011), read in the U.S. Reports print on 26 August 2026: willful blindness requires both that “[t]he defendant must subjectively believe that there is a high probability that a fact exists” and that “the defendant must take deliberate actions to avoid learning of that fact,” which “surpasses recklessness and negligence.” ⚠ It is not a constitutional ceiling and this file called it one — Global-Tech is a civil patent case under 35 U.S.C. § 271(b) deciding no constitutional question (E65). ⚠ CRS remains unread in the original.

The second prong is the one this Operation has to clear. The new text below admits evidence that a person “took affirmative steps to be shielded”, which tracks Global-Tech’s deliberate-actions prong. It carries no counterpart to the subjective-belief prong, and under Global-Tech both are required. A reviewer who reads the new sentence as permitting knowledge on shielding alone has found the gap.

NEW TEXT — appended to SEC. 6(b):

In proving that a person acted knowingly or willfully under this subsection, circumstantial evidence may be used, including evidence that the person took affirmative steps to be shielded from information that would have disclosed the violation or the conditions giving rise to it. Responsibility and authority under SEC. 6(d), standing alone, do not establish knowledge.

The second sentence is the concession, and it is written against the Act’s own convenience. It states MacDonald & Watson as a limit on the statute rather than waiting for a defendant to state it first. A reviewer who thinks the first sentence swallows the second has found the objection this cure most needs.

Operation 2 — one word, and it is in the tagged text

SEC. 6(b)(1) reads “knowingly or wilfully”; SEC. 7(b)(5)’s defense-costs proviso reads “a knowing or wilful violation.” That is British spelling on the operative mens rea term of an American felony provision, and it is the only British spelling left in model_act_v3_4.txt. Three consequences, in ascending order of seriousness: a legislative counsel running a conformity check sees an instrument that does not match its own jurisdiction’s usage; a reader searching “willful” in this site’s search bar does not find the felony tier; and the whole federal willful-blindness line above is indexed under a spelling the Act does not use.

NEW TEXT: in SEC. 6(b)(1) and SEC. 7(b)(5), read willfully as willfully and willful as willful.

Why this is a cure and not a correction. model_act_v3_4.txt is tagged and checksummed. A change to it is an amendment with a number, not a sweep — so the commentary around it was normalized to American spelling on 25 August 2026 by check_spelling.py and the instrument was left alone, pending this operation at the revision.

What the repository owes the reader beside the objection

Lyness does not accept MacDonald & Watson’s reasoning as the end of it. At n.150: “This conclusion ignores that both the CWA and the CAA have versions of the doctrine with a mens rea element of ‘knowingly.’” And at the text his footnote 152 supports: the strict-liability form of the doctrine “may be inappropriate under the RCRA’s statutory language, but there is still room under the RCRA to prosecute responsible corporate officers, at least in instances where ‘knowledge’ is implied by the evidence.”

That is the shape of the answer. MacDonald & Watson does not bar a knowledge-tier RCO offense. It bars using responsibility as a substitute for knowledge. The Act may keep its felony tier; it may not reach it through SEC. 6(d).

The answer the same line already supplies, and it is better than the objection

United States v. Iverson, 162 F.3d 1015 (9th Cir. 1998) is a Clean Water Act prosecution in which the responsible-corporate-officer instruction was given and upheld. The court described exactly what the instruction did and did not do — ✅ read in the opinion 25 August 2026, transcribed character for character:

“Read together with the previous instruction, the ‘responsible corporate officer’ instruction relieved the government only of having to prove that defendant personally discharged or caused the discharge of a pollutant. The government still had to prove that the discharges violated the law and that defendant knew that the discharges were pollutants. Thus, read as a whole, the instructions were not erroneous in the manner that defendant asserts.”

Two words in the version this project published until today were not the court’s. We printed “violated the [CWA]” where the opinion says “violated the law”, and “were pol[lutants]” where it says “were pollutants” — editorial brackets that were never in the original and, in the first case, narrowed a general word into a specific statute. See E48. The pincite 1026 is still the secondary source’s: the text was read in a source carrying no star pagination, so under E47 the page is unconfirmed. That is the whole architecture in one sentence, and it is the architecture this cure proposes. Responsible-officer status replaces the act element. It does not replace the knowledge element. MacDonald & Watson and Iverson are not in tension: the first forbids using responsibility as a substitute for knowledge, and the second confirms that an RCO instruction which does not attempt that substitution survives.

So SEC. 6(b)(1) may keep its felony tier and its “knowingly or wilfully,” provided the prosecution proves knowledge by ordinary means — including the willful blindness route Congress codified. What it may not do is reach knowledge through SEC. 6(d).

And Iverson carries a second holding this project has never used. On why Park’s refinement applies to the CWA at all — ✅ read in the opinion 25 August 2026, the paragraph entire:

“In 1987, after the Supreme Court decided Park, Congress revised and replaced the criminal provisions of the CWA. (Most importantly, Congress made a violation of the CWA a felony, rather than a misdemeanor.) In replacing the criminal provisions of the CWA, Congress made no changes to its ‘responsible corporate officer’ provision. That being so, we can presume that Congress intended for Park’s refinement of the ‘responsible corporate officer’ doctrine to apply under the CWA.”

A legislature that re-enacts around a doctrine adopts it. That is an argument available to any state adopting this Act on top of a framework statute it has already passed.

The parenthetical is the part this project needed and did not have. Our published version cut the paragraph off before it and dropped the closing “under the CWA” without an ellipsis. Restored, the paragraph says something the criminal topic has been arguing around all day: the Ninth Circuit applied Park’s responsible-officer refinement to a statute it had just told us Congress made a felony. Ahmad, below, says CWA discharges cannot be public welfare offenses precisely because they are “felonies punishable by years in federal prison.” Iverson supplies the premise of Ahmad’s argument in a parenthetical and then declines its conclusion.

Those two are not squarely reconcilable and neither case tries. The reconciliation this cure offers — that RCO relieves the act element while knowledge is proved by ordinary means — is available on both sets of facts, and it is our reconciliation, not a court’s. A reviewer who thinks a felony tier cannot rest on a doctrine grown in the misdemeanor soil of Dotterweich has the two cases lined up to say so.

⚠ The pincites 1024 and 1023–24 are still the secondary source’s; the source read carries no star pagination (E47). Lyness, 64 B.C. L. Rev. 253, remains unread in the original.

Operation 3 — the instruction a circuit has already approved, which the Act should be measured against

Iverson sets out the responsible-corporate-officer instruction the district court gave and the Ninth Circuit upheld. ✅ Read in the opinion 25 August 2026:

“1. That the defendant had knowledge of the fact that pollutants were being discharged to the sewer system by employees of CH2O, Inc.; 2. That the defendant had the authority and capacity to prevent the discharge of pollutants to the sewer system; and 3. That the defendant failed to prevent the on-going discharge of pollutants to the sewer system.”

Knowledge of the fact. Authority and capacity to prevent. Failure to prevent. That is a three-element structure, approved on appeal in a federal criminal prosecution, and it is very close to what Amendment 8 reconstructs SEC. 6 into. Element 1 is knowledge of the fact, not knowledge of illegality — which is also the answer to Johnson & Towers’s outlier requirement that the defendant know a permit was required.

And the test behind the instruction is narrower in the Act than in the circuit. Iverson states it directly:

“Under the CWA, a person is a ‘responsible corporate officer’ if the person has authority to exercise control over the corporation’s activity that is causing the discharges. There is no requirement that the officer in fact exercise such authority or that the corporation expressly vest a duty in the officer to oversee the activity.”

Set that beside SEC. 4(a). The Act agrees on both of Iverson’s negatives — it reaches a person who “possesses or exercises” the authority, and SEC. 4(b) provides that “substance controls over title” — but it then adds three qualifiers the federal test does not have. Authority must be final, material and independent, and SEC. 4(a) excludes by name “title, office, seniority, or status; professional credentials or technical ability; access to systems, weights, or infrastructure; the ministerial execution… of a decision made by another; or the provision of advice, analysis, or recommendation.”

So on the authority element this Act is narrower than the standard a federal court of appeals has already approved in a criminal case. That is an answer to the overbreadth objection the project did not previously have, and it should be stated wherever SEC. 4 is defended.

One drafting collision, and it is a word rather than a doctrine. The approved instruction’s element 2 is “the authority and capacity to prevent.” SEC. 4(a) closes with “the authority to decide, not the capacity to act.” The two senses differ — the instruction means power over the outcome, the Act means the ability to perform the operation personally, which is how it keeps the engineer with root access outside SEC. 4 — but the same word does opposite work in the Act and in the instruction it most resembles, and SEC. 6(d)’s “genuine absence of power” is Iverson’s sense, not SEC. 4(a)’s. A legislative counsel will circle this. It costs nothing to fix and it has not been fixed.

The best objection, stated because this cure would rather lose here than in a hearing

United States v. Ahmad, 101 F.3d 386 (5th Cir. 1996) holds that the § 1319(c)(2)(A) offenses of which Ahmad was convicted are not public welfare offenses, and that “the mens rea of knowledge applies to each element of the crimes.” ✅ Read in the opinion 26 August 2026.

The ground is mistake of fact. Ahmad discharged what the court calls “a large quantity of gasoline” from a leaking tank into a town’s sewers, and the court’s stated worry is the person on the other side of that fact: “if knowledge is not required as to the nature of the substance discharged, one who honestly and reasonably believes he is discharging water may find himself guilty of a felony if the substance turns out to be something else.” The controlling test it takes from Staples is “whether ‘dispensing with mens rea would require the defendant to have knowledge only of traditionally lawful conduct’” (quoting Staples, 511 U.S. at 618).

⚠ The felony point is a confirming reason and this project published it as the ratio. The opinion’s own sentence: “The fact that violations of § 1319(c)(2)(A) are felonies punishable by years in federal prison confirms our view that they do not fall within the public welfare offense exception.” We had been writing that the offenses are not public welfare offenses because they are felonies. That inverts the reasoning. See E56.

⚠ And Ahmad does not think it is splitting with Weitzenhoff. On the Ninth Circuit’s case it says the court “was concerned almost exclusively with whether the language of the CWA creates a mistake-of-law defense. Both cases are easily distinguishable, for neither directly addresses mistake of fact or the statutory construction issues raised by Ahmad.” The disagreement that survives is narrower than a split: it is about what Staples at 618 decided, and there Weitzenhoff at 1286 n.7 is directly opposed. And Justice Thomas, dissenting from the denial of certiorari in Hanousek v. United States, 528 U.S. 1102 (2000): the CWA “imposes criminal liability for persons using standard equipment to engage in a broad range of ordinary industrial and commercial activities.”

Read against this Act, that is an attack on the felony tier’s entire framing, and it is sharper than the knowledge objection this cure was opened to answer. Training and deploying a model is ordinary commercial activity. If a court took Ahmad’s view, the public-welfare label would not carry SEC. 6(b) at all, and the tier would need a conventional mens rea of its own rather than a relaxed one.

⚠ Both quoted from the CRS report Enforcement of Federal Pollution Control Laws, not from the reporters. E22 governs.

The answer, added 26 August 2026 on reading the case Ahmad argues against. ✅ United States v. Weitzenhoff, 35 F.3d 1275, 1286 n.7 (9th Cir. 1993) (as amended 8 Aug. 1994), read in the amended opinion in a star-paginated copy:

“While the Staples opinion expresses concern with this evolution of enhanced punishments for public welfare offenses, it refrains from holding that public welfare offenses may not be punished as felonies.”

Ahmad treats Staples as having settled that a felony cannot be a public welfare offense. Weitzenhoff reads the same passage as declining to settle it, and quotes the Court saying so: “[w]e need not adopt such a definitive rule of construction to decide this case.” Hanousek, 176 F.3d 1116, 1122 n.4 (9th Cir. 1999), then rejects the penalty argument by name — “this argument was rejected in Weitzenhoff.”

But the objection should be read at full strength, and its full strength is not in Ahmad. It is in the dissent from the order rejecting rehearing en banc in Weitzenhoff itself, at 1293–1299, where Kleinfeld, J., joined by Reinhardt, Kozinski, Trott and T.G. Nelson, JJ., wrote:

“We have now made felons of a large number of innocent people doing socially valuable work. They are innocent, because the one thing which makes their conduct felonious is something they do not know.”

and, in the sentence this project will meet in its own hearings:

“If they knew they risk three years in prison, some might decide that their pay, though sufficient inducement for processing the public’s wastes, is not enough to risk prison for doing their jobs.”

Five federal appellate judges stated the chilling-effect objection to this Act’s own architecture, about sewage plant operators, in 1994. Whoever takes the criminal-law reviewer should be handed that paragraph rather than Ahmad’s summary of it. What the reviewer’s question now is: not “can a felony be a public welfare offense” — a circuit has answered that twice — but whether SEC. 6(b)’s knowledge element is enough to keep this Act on the panel’s side of the line rather than the dissent’s.

Administrative load: none. Element and evidence provisions only.

Held open for the criminal-law reviewer. Whether the shielding sentence and the SEC. 6(d) carve-out can coexist without the first eating the second; whether a state that has not adopted a willful-blindness instruction can be given one by statute; and whether the Act should follow the First Circuit or the Third on knowledge of the permit requirement, which here means knowledge that SEC. 5 applied at all.

Amendment 23 — SEC. 3(c)(4)(B): restore the publication the allied statutes require, on their own redaction terms

Opened 25 August 2026 by maintainer decision, not by a topic finding and not by the internal review. It changes what the Act requires rather than repairing what it says, and it should be read on that footing. The occasion was a reader’s question — whether sealing everything conflicts with the transparency statutes this project treats as allies — and the answer turned out to be yes.

The defect

The three enacted frontier statutes share one operative sentence, enacted three times in thirteen months in the three states where frontier developers sit: write, implement, comply with, and clearly and conspicuously publish a frontier AI framework. SEC. 3(c)(4) adopts those texts as this Act’s interim standards. And then SEC. 3(c)(4)(B) takes the sentence apart.

ANCHOR (SEC. 3(c)(4)(B), verbatim from the tagged text): “a duty to publish, or to transmit any document to an officer, agency, or the public of an enacting jurisdiction, is performed under this Act by transmission to the Agency, and publication is permitted but not required by this Act.”

Two consequences, and the second is worse than the first.

Where the allied statute is already in force — California, New York, Illinois — nothing is lost. Their publication duties operate on their own terms and this Act adds a person layer above them.

Where it is not, an adopting state gets the framework duty with its visible half removed. A state that enacts this Act alone gives its residents less than California gives Californians, using California’s words. That is not a drafting slip; SEC. 3(c)(4)(B) does it deliberately, and the deliberateness is the problem, because nothing in the drafting record explains the choice.

And there is a political cost that this file should state rather than leave to be discovered. A legislator who wrote a publication statute, invited to carry a model act that adopts her text and converts publishing into filing, is entitled to ask why. This project would have no answer.

Why the obvious fix is wrong

The reason to seal is real. Incident reports describe how a system escaped, which is close to instructions; training corpora and evaluation results are trade secrets; and compelled publication of a trade secret is the count a frontier developer actually litigates. In X.AI LLC v. Bonta, No. 2:25-cv-12295 (C.D. Cal.), the complaint against AB 2013 leads with per se and regulatory takings and reaches speech third (the standing watch § 1). Publishing everything hands that count its best fact.

So neither pole works: sealing everything abandons the allies, publishing everything abandons the defense.

The answer, which an ally already drafted

California Business and Professions Code § 22757.12(f), enacted at SB 53 and already adopted by this Act as an interim standard:

“(1) When a frontier developer publishes documents to comply with this section, the frontier developer may make redactions to those documents that are necessary to protect the frontier developer’s trade secrets, the frontier developer’s cybersecurity, public safety, or the national security of the United States or to comply with any federal or state law.

(2) If a frontier developer redacts information in a document pursuant to this subdivision, the frontier developer shall describe the character and justification of the redaction in any published version of the document to the extent permitted by the concerns that justify redaction and shall retain the unredacted information for five years.”

Publish; redact for trade secrets and security; say what you redacted and why; keep the unredacted copy. Nothing secret is surrendered, so the takings theory has nothing to appropriate. The mechanism of an escape stays sealed. The document is public. And the justification for each redaction is itself published, which is the part that keeps the mechanism from swallowing the rule.

This Act already adopted that subdivision and then disapplied it. SEC. 3(c)(4)(B) is the only reason it does not operate.

Operation 1 — restore publication, on the adopted terms

NEW TEXT — replacing SEC. 3(c)(4)(B):

(B) A duty to publish under an interim standard is performed under this Act by publication in the manner that standard requires, together with transmission to the Agency; a duty to transmit a document to an officer or agency of an enacting jurisdiction is performed under this Act by transmission to the Agency alone. A person publishing under this subparagraph may redact, and shall describe the character and justification of each redaction, on the terms of Section 22757.12(f) of the California Business and Professions Code as adopted by this paragraph; the unredacted document is a record under SEC. 12 and is retained, produced, and treated as SEC. 12 provides.

Why the split. A duty to publish is a duty to the public and should survive adoption. A duty to file with a named state office is a duty to an administrator and is properly performed here by filing with the Agency. The tagged text collapses both into filing; this separates them.

Operation 2 — say what is not published, and why

Restoring publication must not be read to reach the material SEC. 12 seals. The distinction is the one the takings answer depends on and it should be visible in the text rather than inferred.

NEW TEXT — appended to SEC. 3(c)(4)(B):

Nothing in this subparagraph requires the publication of a report under SEC. 9, a certification under SEC. 8 beyond the facts stated in any register maintained under that section, or validation materials under subsection (b) or paragraph (2). Those materials are governed by SEC. 12.

So the shape of the Act after this cure: the framework is published, with reasoned redactions. The incident report is filed. The certification’s facts are on a public register (Amendment 21) and its content is filed. Three tiers, each matched to what the document is for.

What this does not settle, and a reviewer should

Whether the redaction power swallows the duty. SB 53 lets the developer decide what is a trade secret and what is a cybersecurity concern, subject only to describing the justification. No agency approves it and no penalty attaches to over-redaction as such. If that is a rule in name only, this cure imports a rule in name only, and the honest response would be to add review rather than to pretend the problem is elsewhere. The torts and design reviewer and the enforcement reviewer both touch this; neither has been asked.

Whether publication should reach beyond the framework. This cure restores exactly what the allied statutes require and no more. A reviewer who thinks the incident reports should also be public — that a regulator-only channel makes the public depend on the regulator acting, and that this project’s own evidence base exists only because a victim published rather than filed (E28) — is making a serious argument that this cure does not answer.

Administrative load: none on the Agency. The publication is by the regulated person, on terms that person already meets in three states.

Amendment 24 — SEC. 8: the certification’s lower tier names a mental state SEC. 6(a) does not require

*/pre-review.md), on reading 18 U.S.C. § 1350 and 33 U.S.C. § 1319(c) in the primary. *

The defect

ANCHOR (SEC. 8, closing sentence, verbatim): “Knowing false certification is an offense under SEC. 6(b)(1); reckless certification without reasonable inquiry is an offense under SEC. 6(a).”

SEC. 6(a)’s element is that the person “failed to exercise due care,” measured against “the conduct of a reasonably prudent controlling person in like circumstances.” That is negligence. SEC. 8 advertises recklessness, which is higher. A certification made negligently without reasonable inquiry satisfies SEC. 6(a) while SEC. 8 says it does not.

It is a fair-notice defect in the one provision the Act exists to make a natural person sign.

What the models actually say

18 U.S.C. § 1350 — ✅ read in full 25 Aug 2026 — has no tier below knowledge. (c)(1): “knowing” — $1,000,000 / 10 years. (c)(2): “willfully… knowing” — $5,000,000 / 20 years. An executive who certifies without adequate inquiry, not knowing the report is non-compliant, commits no offense under it. So § 1350 cannot be the donor of SEC. 8’s second limb, and the Act names no other.

33 U.S.C. § 1319(c) — ✅ read in full 25 Aug 2026 — is the donor. (c)(1) punishes one who “negligently violates,” imprisonment not more than one year on a first conviction; (c)(6) provides that for the whole of subsection (c) “the term ‘person’ means, in addition to the definition contained in section 1362(5), any responsible corporate officer.” Federal law has imposed criminal liability on a responsible corporate officer for merely negligent violation, at the misdemeanor level, since 1987. That is SEC. 6(a) limb for limb, including SEC. 10(b)’s one-year ceiling.

Operation 1 — the tagged text, one clause

NEW TEXT — replacing SEC. 8’s closing sentence:

Knowing false certification is an offense under SEC. 6(b)(1); certification without reasonable inquiry is an offense under SEC. 6(a), which requires proof of the failure of due care described in that subsection.

Operation 2 — the Comments, one citation

n.8 defends SEC. 8 from § 1350 by argument from practice — its maxima are three to six times this Act’s base felony tier, and “executives have signed under harsher terms every quarter since 2002.” That argument reaches the ceiling and is silent on the floor. The note should carry § 1319(c)(1) with (c)(6) as the second model, and United States v. Hanousek, 176 F.3d 1116 (9th Cir. 1999) — ✅ read in the opinion 26 August 2026, confirmed character for character on two independent sources and held in the working library — for the holding:

“We conclude from the plain language of 33 U.S.C. § 1319(c)(1)(A) that Congress intended that a person who acts with ordinary negligence in violating 33 U.S.C. § 1321(b)(3) may be subject to criminal penalties.”

✅ Pincites confirmed 26 August 2026 against the West reporter print, 176 F.3d 1116–1126, held in the working library: the holding at 1121, and a second, differently worded statement of it in the CONCLUSION at 1126 — “may be subjected to criminal penalties” — which anyone quoting must not conflate with the 1121 sentence.

What the read produced beyond the holding, and it is larger than this cure

One. There is a circuit split on the question the criminal topic calls unanswerable, and this project has been citing only one side of it. Hanousek holds, twice, that “The criminal provisions of the CWA constitute public welfare legislation,” resting on United States v. Weitzenhoff, 35 F.3d 1275, 1286 (9th Cir. 1993). Ahmad holds the opposite for the § 1319(c)(2)(A) counts before it, on a mistake-of-fact ground, with the felony penalty stated as confirming that view rather than producing it. The internal review records Ahmad as the sharpest attack available and says nobody in-house can settle it.

A court has settled it, and the case was already on the source library. ✅ Weitzenhoff read in the amended opinion 26 August 2026, in a copy carrying continuous star pagination 1279–1299. At 1286 n.7, verbatim:

“While the Staples opinion expresses concern with this evolution of enhanced punishments for public welfare offenses, it refrains from holding that public welfare offenses may not be punished as felonies.”

That is Ahmad’s premise refused at its source. Ahmad reads Staples as forbidding public-welfare treatment of felonies. Weitzenhoff reads the same passage of Staples as expressly declining to adopt that rule, quoting the Court: “[w]e need not adopt such a definitive rule of construction to decide this case.” The same footnote lists three public welfare offenses already punished as felonies — International Minerals (ten years where death or injury results), Freed, 401 U.S. 601, 609–10 (five years for an unregistered grenade), and Hoflin, 880 F.2d 1033 (two years under RCRA).

And Hanousek rejects the penalty argument by name, at 176 F.3d 1122 n.4: Hanousek argued that “the harsh penalties that may be imposed for violations of § 1319(c)(1) are another indication that the law of ‘public welfare’ offenses should not be applicable,” and the court answered in one line — “this argument was rejected in Weitzenhoff,” citing 35 F.3d at 1286 n.7.

⚠ Two limits on that quotation, both recorded rather than smoothed over. The inner words are Hanousek’s brief, quoted by the court, not the court’s own; only the eight-word answer is the Ninth Circuit speaking. And both scans of the West print carry a stray hyphen at a line break (“penalties- that”), which is removed here as a typesetting artifact and not as an elision (E48).

One point of chronology that makes this stronger than it looks. The entire Staples discussion, footnote 7 included, was added by the 8 August 1994 order amending the opinion. The original at 1 F.3d 1523 was filed before Staples came down. So this is not a court brushing past a new Supreme Court case; it is a panel reopening its own opinion to answer one.

The honest limit, and it is the reason this stays a topic question. Weitzenhoff is a Ninth Circuit footnote reading a Supreme Court reservation. It defeats the claim that Staples has already decided the question. It does not decide the question. A state court in a Fifth Circuit state has Ahmad to follow and nothing in this Act to stop it.

Two. The due process answer is broader than SEC. 6(a) and the Act has never stated it. Verbatim:

“It is well established that a public welfare statute may subject a person to criminal liability for his or her ordinary negligence without violating due process.”

citing United States v. Balint, 258 U.S. 250, 252–53 (1922) — the 1922 case both Dotterweich and Park rest on, and which was absent from this repository until today. That sentence is the constitutional defense of SEC. 6(a)’s entire design, and known objections argues the point without it.

Three. The canon in Hanousek makes this cure urgent rather than tidy. The court reasoned that Congress wrote “gross negligence” into 33 U.S.C. § 1321(b)(7)(D) and not into § 1319(c)(1)(A), and that “where Congress includes particular language in one section of a statute but omits it in another section of the same Act, it is generally presumed that Congress acts intentionally and purposely in the disparate inclusion or exclusion.”

Apply that to this Act’s own text. SEC. 8 says “reckless certification without reasonable inquiry”; SEC. 6(a), where SEC. 8 sends it, requires only the failure of due care. A court applying Hanousek’s canon would presume that disparity deliberate and give it meaning — most likely by reading SEC. 8’s second limb as reaching only recklessness, which is not what SEC. 6(a) says. The mismatch is not untidy drafting. It is drafting a court has a rule for.

Four, recorded because it points the other way. Hanousek was a roadmaster — “responsible under his contract for every detail of the safe and efficient maintenance and construction of track, structures and marine facilities of the entire railroad.” Not an officer. The CWA’s responsible person therefore reaches an operational supervisor, where SEC. 4(a) expressly excludes “the ministerial execution, implementation, or communication of a decision made by another.” This Act is narrower than its own model, for the third time this week.

And it takes the sting out of Ahmad. Ahmad refuses public-welfare treatment to the § 1319(c)(2)(A) counts before it, and offers as confirmation that those violations “are felonies punishable by years in federal prison.” § 1319(c)(1) is a misdemeanor. Whatever Ahmad does to a felony tier it does not reach a one-year negligence offense, which makes SEC. 6(a) the least exposed part of the federal analogy rather than the most.

The alternative a reviewer should weigh and this cure rejects: raise SEC. 6(a) to the recklessness SEC. 8 advertises. That buys the § 1350 analogy and abandons the negligence floor DeCoster says Park supplies — trading a defensible doctrine for a defensible analogy.

Administrative load: none.

Amendment 25 — SEC. 10(d): the FDCA remedies are cited and their protections are not taken

*/pre-review.md), on reading 21 U.S.C. §§ 332 and 334 in the primary. *

Operation 1 — the jury the source supplies in exactly this case

SEC. 10(d)(2) provides that operation of a suspended configuration by a person with notice “is contempt and a violation of SEC. 5(a).” That double character is the precise case 21 U.S.C. § 332(b) legislates for — ✅ read 25 Aug 2026:

“In case of violation of an injunction or restraining order issued under this section, which also constitutes a violation of this chapter, trial shall be by the court, or, upon demand of the accused, by a jury.”

The Act cites § 332 for the injunction and drops § 332(b). Ordinary law supplies a jury only where the contempt sentence is serious; § 332(b) supplies it by statute whenever the two characters overlap. A defendant protection lost by omission.

NEW TEXT — SEC. 10(d), new final sentence:

In any proceeding for contempt of an order under this subsection where the conduct also constitutes a violation of SEC. 5, trial shall be by the court or, upon demand of the accused, by a jury.

Operation 2 — the § 334 citation over-claims

§ 334 — ✅ read 25 Aug 2026 — is in rem: an article “proceeded against… on libel of information and condemned,” procedure conforming “as nearly as may be, to the procedure in admiralty,” and “on demand of either party any issue of fact… shall be tried by jury.” SEC. 10(d)(2) takes the thing-directed idea and none of the apparatus, while binding “any person with notice.”

Functionally it is prospective and injunctive — § 332’s relative, not § 334’s. Either re-cite it to § 332 and describe it as the injunction it is, which costs nothing; or keep the § 334 framing and import what makes an in rem remedy fair — a right for any person claiming an interest in the identified configuration to appear and contest before the suspension binds them.

And it touches the takings topic. A remedy operating on the thing rather than on conduct sits closer to Cedar Point’s per se limb than to Penn Central’s regulatory one, and known objections does not make that connection.

Administrative load: none for the re-citation; an appearance procedure for the alternative.

Amendment 26 — SEC. 3(c)(4): the disapplication list, repaired against a full read of all three adopted standards

/pre-review.md), PF-10 and PF-11. Until 25 August, two of the three statutes this subsection adopts had been word-searched and never read. All three have now been read in full.

Why the list was incomplete

SEC. 3(c)(4) adopts three enacted statutes and disapplies an enumerated list of their features. The list was drafted from the categories the drafter expected, and a word search establishes what a statute lacks, not what it contains. Reading all three found four items the list did not anticipate.

Operation 1 — (C) is broader than its purpose

ANCHOR: “(C) provisions respecting assessment or audit by a third party do not apply, and conformity may be documented internally, independent assessment being at the entity’s election.”

Illinois § 10(a)(5) and N.Y. § 1421(1)(e) require the framework to describe how the developer approaches “using third parties to assess the potential for catastrophic risks”; Illinois § 10(c)(2)(C) and N.Y. § 1421(3)(b)(iii) require the transparency report to summarize “the extent to which third-party evaluators were involved.” None is a mandate to be audited. All are transparency about the developer’s own practice, and (C) on its face takes them.

NEW TEXT — replacing (C):

(C) provisions requiring assessment or audit by a third party do not apply, independent assessment being at the entity’s election and conformity being documentable internally; but provisions requiring an entity to state whether, and to what extent, third-party assessment was used do apply, and are performed as subparagraph (B) provides.

The Guidelight control assessment of 18 August 2026 found third-party review among the weakest dimensions across all five frontier developers while four of five participated in METR’s Frontier Risk Report voluntarily. The disclosure is the part doing work, and (C) removes it along with the mandate.

Operation 2 — (D) deletes the capability and keeps the report

ANCHOR: “(D) provisions respecting incident reporting… are not adopted, those subjects being governed from the effective date by SEC. 9, SEC. 10, and SEC. 11 of this Act.”

Illinois § 10(a)(8) and N.Y. § 1421(1)(h) require the framework to address “identifying and responding to critical safety incidents.” That is a capability requirement owed inward, not a reporting provision. Read broadly, (D) removes it, leaving SEC. 9’s duty to tell the Agency with nothing anywhere requiring the developer to be able to identify or respond.

NEW TEXT — appended to (D):

provided that provisions requiring a frontier AI framework to address the identification of, and response to, critical safety incidents are adopted and are not incident-reporting provisions for the purposes of this subparagraph.

Operation 3 — three standards, no conflict rule

Illinois § 10(c)(3) requires transparency summaries “in a machine-readable format”; New York has no such requirement. N.Y. § 1421(4) carries a duty not to make “a materially false or misleading statement about its implementation of, or compliance with, its frontier AI framework” and, at (4)(b), a defense for a statement “made in good faith and was reasonable under the circumstances”; Illinois § 10 carries neither. California is a third text again.

(E) credits conformity documented for any one of them. It does not say what happens where they diverge, so it is currently unanswerable whether a developer gets New York’s good-faith defense or owes Illinois’ format.

NEW TEXT — new subparagraph (F):

(F) where the adopted provisions differ, the interim standards operate cumulatively, each duty applying according to its terms; a defense or exception stated in one adopted provision applies only to a duty arising under that provision.

This is a maintainer choice, not a repair, and the alternative deserves argument: several operation, where conformity with any one enactment suffices, is simpler and weaker.

Operation 4 — the import nobody has reconciled

N.Y. § 1421(4)(a)(ii) is SEC. 8’s false-certification offense as a substantive duty owed by the entity, with no signatory. The Act adopts it and then builds SEC. 8 above it without noticing. No text is proposed here. Whether the two are one duty described twice or two duties with different obligors changes what a certification means, and it belongs to the enforcement reviewer.

And § 1421(4)(b)’s good-faith-and-reasonableness defense sits directly beside SEC. 8’s “after reasonable inquiry.” Known objections reports that the Act “picks neither” on whether asking a safety team is reasonable inquiry. On this reading it may have picked, by adoption, without saying so — which is the answer to the open question that section has been holding since August.

Administrative load: Operation 1 restores a disclosure line to intake. Operation 3 is a construction rule and costs nothing.

Proposals — the drafted repairs, keyed to v3.4

⚠ HOLD — the internal review of 22 August 2026 supersedes parts of this queue

Decision 1 — SEC. 3(c)(4): does Connecticut become a fourth interim standard?

Decision 2 — SEC. 2 / SEC. 9: does the duty reach an evaluation run with safeguards disabled?

Decision 3 — SEC. 4: the third-party evaluator — does practical authority still run to the officer?

Decision 4 — SEC. 2(a) and SEC. 1(c): the Act does not reach the conduct it was written after

Maintainer ruling, 25 August 2026 — the item splits, and only half of it was ever a federalism question

Amendment 1 — “Serious injury” source moves to 18 U.S.C. § 1365(h)(3)–(4)

⚠ Addendum to Amendment 1, 23 August 2026 — the operative definition’s blind spot, mapped; what Operation 1 already closes; the residue

Amendment 2 — SEC. 13(c): a review valve on the suspension order

Amendment 3 — the regulations, conformed to v3.4

Amendment 4 — SEC. 9(a): the two characterization-shaped triggers, recast as observable events

Amendment 8 — SEC. 6: the individual-liability offense, reconstructed

Amendment 9 — SEC. 10(e): the access authority the Act forgot to import

Amendment 10 — SEC. 3(c)(3): interim controls, so SEC. 5(b) is not dormant until year four

Amendment 11 — SEC. 5: name the obligor; SEC. 9(b): write the duty in the active voice

Amendment 12 — SEC. 5(d): restore the scienter its own donor requires

Amendment 13 — SEC. 1(b)(1)(B): say “sever,” not “extend”

Amendment 14 — SEC. 9(b): a detection clock that cannot be gamed by certifying less monitoring

Amendment 15 — SEC. 3(c)(2): a disclose-and-fix valve, because the text currently punishes candor

Amendment 16 — SEC. 1(b)(7): a deception limb, because Van Buren excludes what actually happened

Amendment 5 — SEC. 8 punctuation

Amendment 6 — SEC. 1(b)(1): the developer’s own designation as a third route into scope

Amendment 7 — the covered frontier enterprise: scope follows the ecosystem, duty follows the function

Intake of 23 August 2026, evening — three new entries and five addenda

Amendment 17 — SEC. 11(d): remedies for a reporter outside employment

Amendment 18 — SEC. 9(b): an immediate-notice tier for incidents in progress

Amendment 19 — SEC. 0(a): the personhood finding the states have begun to enact

Addenda to existing entries, 23 August (evening)

The fatals pass — same evening, second block

Amendment 20 — the chosen-stick clause: conformity outside the Act credits nothing

Amendment 21 — SEC. 8: the certification register, facts public, content protected

COMPANION NOTE (held for v3.5) — SEC. 3: the administrability record

Amendment 22 — SEC. 6(b): the felony tier’s knowledge element, and one word that is not American

The authority the repository was missing

Why it bites here, and exactly where

Operation 1 — take the bridge the pollution statutes already codified

Operation 2 — one word, and it is in the tagged text

What the repository owes the reader beside the objection

The answer the same line already supplies, and it is better than the objection

Operation 3 — the instruction a circuit has already approved, which the Act should be measured against

The best objection, stated because this cure would rather lose here than in a hearing

Amendment 23 — SEC. 3(c)(4)(B): restore the publication the allied statutes require, on their own redaction terms

The defect

Why the obvious fix is wrong

The answer, which an ally already drafted

Operation 1 — restore publication, on the adopted terms

Operation 2 — say what is not published, and why

What this does not settle, and a reviewer should

Amendment 24 — SEC. 8: the certification’s lower tier names a mental state SEC. 6(a) does not require

The defect

What the models actually say

Operation 1 — the tagged text, one clause

Operation 2 — the Comments, one citation

What the read produced beyond the holding, and it is larger than this cure

Amendment 25 — SEC. 10(d): the FDCA remedies are cited and their protections are not taken

Operation 1 — the jury the source supplies in exactly this case

Operation 2 — the § 334 citation over-claims

Amendment 26 — SEC. 3(c)(4): the disapplication list, repaired against a full read of all three adopted standards

Why the list was incomplete

Operation 1 — (C) is broader than its purpose

Operation 2 — (D) deletes the capability and keeps the report

Operation 3 — three standards, no conflict rule

Operation 4 — the import nobody has reconciled