The proposal differs from policy outcomes preferred by a16z.
I don't have a strong opinion on Obernolte-Trahan yet - this is a draft + there are many factors.
But people should know that, while this is perhaps the weakest thing industry thinks they can get, that's very different from it being "what 16z wants." There are real concessions here.
Users praised the Great American AI Act for its concessions, minimum standards, and pragmatic tradeoffs that struck them as stronger than expected.
More thoughts on Obernolte-Trahan / The Great American AI Act…
Will note flaws inherited from state laws, a win on minimum standards, and start on audits, though won’t finish - many moving parts there.
Bracketing preemption / other stuff that’s not my area of expertise🧵
Many parts of this were well outside the Overton window a year ago, and the idea that this is just an industry wishlist is silly...
(though these things being include is not as surprising to those of us who expected the vibes to shift over time with changing capabilities).
I don't have a strong opinion on Obernolte-Trahan yet - this is a draft + there are many factors.
But people should know that, while this is perhaps the weakest thing industry thinks they can get, that's very different from it being "what 16z wants." There are real concessions here.
Next inherited issue: weak penalties. There are people at these companies that could pay this stuff out of pocket. Not ideal! I am unsure re: what makes sense here and mayyybe there’s an injunctive relief thing that is stronger than the $ cost but I dunno, noting in passing
…and we want to focus scarce safety/security/governance resources. CAISI rulemaking can maybe address this (?), eg by prescribing more hardcore audits for some, but I am not sure re limits.
Possible alt: AI R&D expenses, as argued by @deanwball + @ketanrama, possibly multi tier
It is extremely notable that auditors under GAAIA opine not just on whether the policy is being followed but whether the policy actually (colloquially) is reasonable.
Tons of important details here I don’t understand yet but, going from 0 to 1 here is important.
OK so now on the minimum standards win- this is big, though (to a non-lawyer) confusing!
This *could* have been another inherited flaw - under SB 315, you need a safety/security policy and need to get audited against it… but what if that policy sucks?? Huge loophole. So…
…and we want to focus scarce safety/security/governance resources. CAISI rulemaking can maybe address this (?), eg by prescribing more hardcore audits for some, but I am not sure re limits.
Possible alt: AI R&D expenses, as argued by @deanwball + @ketanrama, possibly multi tier
1. The revenue trigger being necessary, not sufficient, means that a company like Ilya Sutskever’s Safe Superintelligence would not be (fully?) covered, because they’re taking a “straight shot” (to ASI) approach. Seems bad!
2. 10^26 ain’t what it used to be.…
Two more:
One year clock to kick in - would make this slower than (now) SB 53 and (2027) RAISE, though faster than SB 315 (2028).
And I would love some kind of floor on information security standards at least for a subset of 10^26 (again maybe CAISI rulemaking fixes this?).
Next inherited issue: weak penalties. There are people at these companies that could pay this stuff out of pocket. Not ideal! I am unsure re: what makes sense here and mayyybe there’s an injunctive relief thing that is stronger than the $ cost but I dunno, noting in passing
Something I think is strong but I need to understand better: I think CAISI can basically say “continuous auditing is needed for x tier of developer, or this specific one.”
I don’t fully understand this but, given that a lot can also happen in 6 months, this is a good thought…
On the detail - a lot of thought has gone into the role CAISI would play here (which, btw, yay, go CAISI), and it is a strong role, eg credentialing and calling for ad hoc audits.
On strengths vs. SB 315, cadence is a big one - semi annual vs annual. A lot happens in a year!
Weakness: I think there is no direct requirement for publication of redacted audit reports, as there is in SB 315.
As discussed in the article pinned on my profile, this is relevant to fostering learning across the ecosystem, and calling out crappy audits. Need improvement here.
Strength, I think: ability to refer cases/incidents to federal and state (!) authorities.
I don’t fully understand the mechanics here but the intent as I understand it is to make sure actually bad stuff isn’t buried, and that CAISI/feds can’t just decline to enforce anything.
Strength, I think: ability to refer cases/incidents to federal and state (!) authorities.
I don’t fully understand the mechanics here but the intent as I understand it is to make sure actually bad stuff isn’t buried, and that CAISI/feds can’t just decline to enforce anything.
Strength: access. Auditors should be able to get what they need to do their jobs, as I understand the text at least.
This is balanced ofc with a need for protecting IP, via a mix of standards for auditors and FOIA exemption.
GAAIA follows the copy/paste model taken by the states so far - SB 53 from CA gets copied to NY and extended a bit for RAISE, that gets copied to IL and extended a bit.
Same deal here (to avoid relitigating stuff) but that has some costs we should be aware of.
More thoughts on Obernolte-Trahan / The Great American AI Act…
Will note flaws inherited from state laws, a win on minimum standards, and start on audits, though won’t finish - many moving parts there.
Bracketing preemption / other stuff that’s not my area of expertise🧵
I think the calculation here from a safety/security person POV is complicated and involves, e.g., how much you think it's important for the federal government to start ramping up its capacity by when, how quickly you think AI will develop, what's doable at a state level, etc.
Many parts of this were well outside the Overton window a year ago, and the idea that this is just an industry wishlist is silly...
(though these things being include is not as surprising to those of us who expected the vibes to shift over time with changing capabilities).
Another strength: credentialing *plus* liability protections for auditors is a powerful mix for incentivizing investment in the ecosystem.
CAISI can yank an auditor’s license if they suck, but they are protected from eg a company blaming them for the company’s product failure.
…albeit one that relies a lot on the CAISI Director making reasonable calls, and, as noted elsewhere, CAISI is in a tricky situation today and moreso if it starts writing standards with teeth.
I am unsure yet if GAAIA creates enough protection from CAISI politicization.
1. The revenue trigger being necessary, not sufficient, means that a company like Ilya Sutskever’s Safe Superintelligence would not be (fully?) covered, because they’re taking a “straight shot” (to ASI) approach. Seems bad!
2. 10^26 ain’t what it used to be.…
E.g.: the 10^26 threshold, which was mentioned as an illustrative idea in the paper Frontier AI Regulation and then stuck, also shows up here. Likewise for the revenue trigger stuff.
Two problems with this (not saying they are deal breakers but we should be aware):
OK now for auditing - again I won’t be able to be comprehensive here (both bc I haven’t had a chance to think through it all, consult lawyers, etc. and because my thumbs are gonna get sore soon), but I will give some flavor of where things are at here.
It is extremely notable that auditors under GAAIA opine not just on whether the policy is being followed but whether the policy actually (colloquially) is reasonable.
Tons of important details here I don’t understand yet but, going from 0 to 1 here is important.
E.g.: the 10^26 threshold, which was mentioned as an illustrative idea in the paper Frontier AI Regulation and then stuck, also shows up here. Likewise for the revenue trigger stuff.
Two problems with this (not saying they are deal breakers but we should be aware):
GAAIA follows the copy/paste model taken by the states so far - SB 53 from CA gets copied to NY and extended a bit for RAISE, that gets copied to IL and extended a bit.
Same deal here (to avoid relitigating stuff) but that has some costs we should be aware of.
OK I am near the end of the tweet thread limit (TIL that’s a thing).
Didn’t cover everything but I will end here and link to my earlier threads, and may add another later.
I said “I think” and “direct” because again, there is a LOT going on in this draft, and eg model-related reports need to comment on working with third parties so maybe that’s an indirect push for audit transparency but I think it is not enough per my current understanding.
Again I'm not well equipped to comment on the details here - this is not a design feature I've studied closely, and I'm also not a lawyer, so won't argue with you re: it being extreme in that direction.
But I do think this is an area with tradeoffs (we also don't want to prevent any investment in the ecosystem, nor shift liability from the company to the IVO), and at the very least I'm glad it's on their radar. Would have a higher bar for endorsing it, which I'm not doing
In short, the audit provisions are worked out in enough detail to at least semi-address ~all major Qs one might have abt an audit requirement, and they are stronger than SB 315 in multiple ways, but maybe weaker in some ways, and in other ways I just need to understand it better.
OK now for auditing - again I won’t be able to be comprehensive here (both bc I haven’t had a chance to think through it all, consult lawyers, etc. and because my thumbs are gonna get sore soon), but I will give some flavor of where things are at here.
On the detail - a lot of thought has gone into the role CAISI would play here (which, btw, yay, go CAISI), and it is a strong role, eg credentialing and calling for ad hoc audits.
On strengths vs. SB 315, cadence is a big one - semi annual vs annual. A lot happens in a year!
In short, the audit provisions are worked out in enough detail to at least semi-address ~all major Qs one might have abt an audit requirement, and they are stronger than SB 315 in multiple ways, but maybe weaker in some ways, and in other ways I just need to understand it better.
But any serious policy conversation on this topic needs to start from a recognition that this is a completely different situation from the "preemption for nothing" push a while back.
What to do about that (wait for something even better, get started now) is more complicated.
Certainly would not encourage anyone to support "whatever's on offer" blindly.
People should point out issues here, and I will do so as well (e.g. there's some great audit stuff but it could be improved, and more informed people than me have concerns about preemption details).