Cloud Security Act
Sponsored By: Representative Gottheimer, Josh [D-NJ-5]
Introduced
Summary
Lets cloud and AI companies share limited customer data with the Secretary of Commerce to verify compliance with U.S. export controls. It would set narrow purposes and limits on what can be disclosed and define which AI models, chips, and cloud products are covered.
Show full summary
- Cloud and AI providers would be allowed to disclose customer content and records to the Commerce Secretary or designated officials for verification, notification, referral, or reports tied to export-control rules. Disclosures must be in good faith and limited to information reasonably necessary.
- Developers and cloud customers would see certain uses tracked because the bill defines an "AI model" as trained on broad data, generally self-supervised, and containing at least 1,000,000,000 parameters. The bill also defines "covered cloud product" to include infrastructure, platform, or software services used to develop or run those models.
- The Commerce Department would gain clearer authority to obtain information about covered integrated circuits and related cloud services to enforce the Export Control Reform Act. The bill ties covered chips to specific export control classification numbers and to high performance thresholds for processing and bandwidth.
Personalized for You
How does this bill affect your finances?
Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Bill Overview
Analyzed Economic Effects
1 provisions identified: 0 benefits, 0 costs, 1 mixed.
New cloud disclosure for export checks
If enacted, this bill would let cloud providers send customer content and records to the Secretary of Commerce or a designated officer. Disclosures would be only for export-control verifications, notifications, referrals, reports, or to follow Export Control Reform Act regulations. Providers must believe in good faith the data relates to a covered cloud product. The use must be by a specified foreign entity or by an agent acting for that entity. Disclosures must be limited to information reasonably necessary to make or prove the verification or report. The bill defines "AI model" as having at least 1,000,000,000 parameters. It defines "covered cloud product" as IaaS used to build or run such models, or PaaS/SaaS with similar compute. It defines covered chips by ECCN 3A090/4A090, similar chips, or chips meeting certain speed or bandwidth thresholds. The Commerce Secretary would be allowed to change the chip definition starting 24 months after enactment. If enacted, this would help enforce export rules but narrow some customer privacy protections and add compliance duties for providers.
Sponsors & CoSponsors
Sponsor
Gottheimer, Josh [D-NJ-5]
NJ • D
Cosponsors
Rep. Moolenaar, John R. [R-MI-2]
MI • R
Sponsored 6/30/2026
Roll Call Votes
No roll call votes available for this bill.
View on Congress.gov