The AI Executive Order: Presidential Authority for Compelled Disclosures for AI Models and Computing Clusters

This client alert is one in a series of alerts on the various aspects of the executive order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence that was signed by President Biden on October 30, 2023.

On October 30, 2023, President Biden signed an executive order (EO) on the development and use of artificial intelligence. While EOs are typically directed to government officials and agencies, and the bulk of this EO is, it is noteworthy for also placing direct obligations on private actors. Specifically, pursuant to the EO, companies (1) developing especially powerful models, or (2) acquiring or developing especially powerful computing clusters, are compelled to make certain disclosures to the federal government.

Biden characterized the EO as “the most significant action any government anywhere in the world has ever taken on AI safety, security, and trust.”

What Models and Computing Clusters Are Covered?

The secretary of commerce, in consultation with the director of national intelligence and secretaries of state, defense, and energy, is tasked with defining, and updating regularly, the technical conditions that will subject models and computing clusters to the reporting obligations described above. However, the MIT Technology Review reported that “a White House spokesperson said that the mandate will be enforceable and apply to all future commercial AI models in the US.”

Until the secretary of commerce sets the conditions for which models and computing clusters are covered, the EO requires the secretary of commerce to require compliance with reporting requirements discussed below:

Model

Any AI model that was trained:

• using a quantity of computing power that exceeds 10^26 integer or floating-point operations (FLOPs); or
• primarily on biological sequence data and trained using a quantity of computing power that exceeds 10^23 FLOPs.

While being a “dual-use foundation model” is not expressly listed as one of the conditions for falling within the purview of the disclosure requirements, the required disclosures (discussed below) only concern dual-use foundation models. The likely explanation for this seeming inconsistency in terminology is that any AI model that meets either of the conditions listed above necessarily is a “dual-use foundation model,” as defined in the EO. The EO defines “dual-use foundation model” as any model that:

• is trained on broad data;
• uses self-supervision (generally);
• contains at least tens of billions of parameters;
• is usable across a wide range of contexts; and
• exhibits, or could be easily modified to exhibit, high levels of performance at tasks that pose a serious risk to security, national economic security, national public health or safety, or any combination of those matters.[1]

One unanswered question is whether any currently disclosed models are covered. A person who was present at the EO briefing shared with Time that a “Biden Administration official said that the threshold was set such that current models wouldn’t be captured but the next generation state-of-the-art models likely would.” And for context, the 175 billion parameter version of GPT-3 required 3.14 x 10^23 FLOPs of computing power to train, which is around 318 times less than the current reporting threshold.[2] (That said, these questions will likely be moot once the secretary of commerce updates these conditions.)

Computing Cluster

Any computing cluster that has:

• a set of machines physically located in a single data center, transitively connected by data center networking of over 100 gigabits per second, and
• a theoretical maximum computing capacity of 10^20 FLOPs per second for AI training. To make these numbers more concrete, this would cover a cluster of around 50,000 Nvidia H100 Tensor Core GPUs using 16-bit floating point (FP16) data formatting (which is the data format used for training neural networks to lower memory requirements).[3]

We expect that the EO will incentivize some to create models and computing clusters that fall right below the established thresholds (as the restrictions on export of advanced semiconductors led Nvidia to develop a special line of chips that fell [for a time] right below the restriction threshold). That incentive may be especially strong for companies that do not want to share sensitive information with the federal government.

Compelled Disclosures Requirements for Covered Models and Computing Clusters.

The EO orders the secretary of commerce to require the following disclosures:

Models

The EO orders the secretary of commerce to require companies developing or demonstrating an intent to develop potential dual-use foundation models to provide the federal government, on an ongoing basis, with information and records regarding:

• Training and Development Plans. Any ongoing or planned activities related to training, development, or producing dual-use foundation models. This information must include information on the physical and cybersecurity protections taken to protect training against sophisticated threats.
• Information on Model Weights. The ownership and possession of the model weights and the physical and cybersecurity measures taken to protect those weights.
• Red-Team Testing Results. The results of any developed dual-use foundation model’s performance in AI red-team testing (i.e., structured testing efforts to find flaws and vulnerabilities in an AI system) based on guidance the National Institute of Standards and Technology (NIST) will develop (according to requirements directed toward NIST in the EO).[4] Before the NIST provides guidance, the EO states[5] that companies must report on any red-teaming conducted related to:
• lowering the barrier to entry for the development, acquisition, and use of biological weapons by non-state actors;
• discovered software vulnerabilities and associated exploits;
• use of software or tools to influence real or virtual events;
• possibility for self-replication or propagation; and
• associated measures to meet safety objectives (though those objectives are not specified in the EO).
• Other Safety Measures. A description of any measures the company takes to meet safety objectives.

Computing Clusters

The EO orders the secretary of commerce to require any individual or entity that acquires, develops, or possesses a potential large-scale computing cluster to:

• report acquisition, development, or possession of a covered computing cluster, including to disclose the location of the clusters and the total computing power available in each cluster.

The EO’s record-keeping and reporting obligations for United States Infrastructure-as-a-Service Providers regarding foreign transactions are discussed in this blog post by our Government Contracts team.

Executive Orders: Source of Authority and Constitutional Questions

Scope of the Defense Production Act

While many leading AI companies have already agreed to make certain voluntary disclosures on AI safety, security, and trust, we expect to see focus in the coming months on the question of whether the president has the authority to compel disclosures by private actors via an EO.

“It is [ ] well established that the substance of an [EO], including any requirements or prohibitions, may have the force and effect of law only if the presidential action is based on power vested in the President by the U.S. Constitution or delegated to the President by Congress. The President’s authority to issue [EOs] does not include a grant of power to implement policy decisions that are not otherwise authorized by law.”[6] So, whenever the president seeks to compel a third party to act via EO, the president must point to a source of that power. Here, the question is what the source is of the president’s power to (1) compel these disclosures from non-government actors and (2) require the secretary of commerce to require those disclosures.

President Biden has taken the position that he is authorized to directly “regulate” private actors and compel these disclosures pursuant to the emergency and war powers delegated to him by Congress in the Defense Production Act (DPA). The DPA was originally passed in 1950, after the broad executive powers granted under the First and Second War Powers Acts of 1941 and 1942 had lapsed, and the outbreak of the Korean War (among other things) led the Truman administration to push for a similar grant of power. The DPA accordingly grants the executive branch certain powers to control defense production (including by non-government actors) and the country’s economy (e.g., by fixing wages and setting price ceilings).[7] Congress has reauthorized the DPA 53 times.

The DPA grants the president an “array of authorities to shape national defense preparedness programs and to take appropriate steps to maintain and enhance the domestic industrial base.”[8] The authority of the president under the DPA is “tied to the definition of national defense, as the use of any major DPA authority must be interpreted to promote, support, or otherwise be deemed needed or essential for the national defense.”[9] “National defense” is defined in the DPA as:

Programs for military and energy production or construction, military or critical infrastructure assistance to any foreign nation, homeland security, stockpiling, space, and any directly related activity. Such term includes emergency preparedness activities conducted pursuant to title VI of The Robert T. Stafford Disaster Relief and Emergency Assistance Act [42 U.S.C. §§5195 et seq.] and critical infrastructure protection and restoration.[10]

Title VI of the Stafford Act defines “emergency preparedness activities” as any activities or measures “designed or undertaken to prepare for or minimize the effects of a hazard upon the civilian population, to deal with the immediate emergency conditions which would be created by the hazard, and to effectuate emergency repairs to, or the emergency restoration of, vital utilities and facilities destroyed by the hazard.”[11]

The question is whether the compelled disclosures in the EO fall under President Biden’s authority granted in these provisions.

[1] See Section 3(k) of the Executive Order.

[2] See Tom B. Brown et al., “Language Models are Few-Shot Learners,” at 46.

[3] See Nvidia, Datasheet, Nvidia H100 Tensor Core GPU. A single H100 SXM (server express module) at FP16 can process 1,979 teraFLOPS. (A teraFLOPS is 10^12 floating-point operations per second.)

[4] See Section 4.1(ii) of the Executive Order.

[5] See Section 4.2(i)(C) of the Executive Order.

[6] Congressional Research Service, “Executive Orders: Issuance, Modification, and Revocation” (updated April 16, 2014).

[7] Congressional Research Service, “The Defense Production Act of 1950: History, Authorities, and Considerations for Congress” (updated October 6, 2023).

[8] Id. at 4 (citing 50 U.S.C. § 4502(a)(4)) (emphasis in original).

[9] Id. (citing 50 U.S.C. § 4552(14)) (emphasis in original).

[10] 50 U.S.C. § 4552(14) (emphasis added).

[11] 42 U.S.C. § 5195(a)(3).