HR-2152-119
Placed on the Union Calendar, Calendar No. 615.
Sponsored by Zachary Nunn (R-IA)
What it does
The AI PLAN Act would require the Secretaries of Treasury, Homeland Security, and Commerce — in consultation with nine other federal officials — to jointly submit a classified report to Congress within 180 days of enactment, and annually thereafter, assessing the national and economic security risks posed by adversarial use of artificial intelligence in financial crimes. The report would cover interagency policies, public-private partnerships, and an inventory of available and needed resources to combat AI-enabled threats such as deepfakes, voice cloning, synthetic identities, and market manipulation. Within 90 days of each report, the same three secretaries would also submit legislative recommendations and best practices for businesses and government entities to mitigate these risks.
Who benefits
U.S. consumers and retail investors who are targets of AI-enabled fraud and scams. Financial institutions that would gain clearer government guidance on AI threat mitigation. Small businesses vulnerable to AI-driven social engineering and cyber breaches. Federal agencies that would receive a coordinated, cross-government assessment of available tools and resource gaps. Cybersecurity and AI defense contractors who may benefit from future procurement driven by the resource gap analysis. Legislators who would receive actionable recommendations for follow-on legislation.
Who is hurt
No group faces direct regulatory burden or cost from this bill, as it is purely a reporting and strategy requirement. Federal agencies would bear administrative costs of producing annual classified reports and recommendations. Congressional staff would face increased workload reviewing classified annexes. To the extent the reports lead to future legislation or regulation, affected industries — financial services firms, technology companies, and AI developers — could face downstream compliance costs not yet defined by this bill.
Supporters argue
Supporters argue that AI-enabled financial crimes are a rapidly escalating threat — the FTC reported consumers lost over $10 billion to fraud in 2023, with AI tools increasingly used to generate synthetic identities, deepfakes, and voice clones that defeat traditional fraud detection. They contend that the federal government currently lacks a unified, cross-agency strategy to address these threats, and that this bill fills that gap by forcing coordination among Treasury, DHS, Commerce, the Fed, the SEC, the FTC, and other key regulators before harm becomes irreversible.
Opponents argue
Opponents argue that the bill creates a reporting mandate without any enforcement mechanism, funding authorization, or binding action requirement — producing classified documents that may sit unread without producing real change. They contend that the federal government already has overlapping AI and financial crime task forces across Treasury's FinCEN, the FBI, and the FTC, and that adding another layer of interagency reporting risks duplicating existing efforts while consuming agency resources that could be directed toward actual enforcement and prosecution of AI-enabled fraud.
Constitutional context
This bill exercises Congress's authority under the Commerce Clause (Art. I, §8, cl. 3) to regulate financial markets and interstate commerce, and its Necessary and Proper Clause authority to require executive branch reporting. No significant constitutional tension is raised, as the bill imposes no regulatory mandates on private parties and does not delegate broad rulemaking authority to agencies — the post-Loper Bright and major questions doctrine concerns that arise from sweeping agency rules are not implicated here.
Checks and balances
The executive branch — specifically Treasury, DHS, and Commerce — gains a structured reporting role and agenda-setting influence through legislative recommendations, but Congress retains authority to act or not act on those recommendations; no new rulemaking power is delegated to any agency.
Historical precedent
The Cybersecurity Information Sharing Act of 2015 similarly required interagency coordination and reporting on cyber threats without imposing direct regulatory mandates, serving as a precursor to more substantive cybersecurity legislation.