Law / United States / 
Pennsylvania
H.B. 2800, Artificial Intelligence Risk Prevention Act
Pa. H.B. 2800, 2025-2026 Regular Session
In committee, dated , as of .
An AI governance rule binding private bodies.
- Obligation class
- Disclosure, Governance, Reporting
- Audit expectation
- periodic
- Who audits it
- Independent third party
- Where the report goes
- Published summary, Filed with regulator
As of .
Where it has got to
The text described here is Printer's Number 3904, as introduced. That print is PN 3904, published .
Locally, this stage is House Communications and Technology Committee.
The stage above is recorded at www.palegis.us.
Introduced and referred to the House Communications and Technology Committee on . The committee calendar lists a public hearing on this bill and House Bill 2829 on , and the status page records no later action. The 2025-2026 session runs through .
What it requires
- If you are a large frontier developer, do not develop, deploy or operate a frontier model, in whole or in part, in Pennsylvania unless you have filed a registration form and a current disclosure statement with the Pennsylvania Emergency Management Agency and paid the annual fee; renew the disclosure statement every year and whenever ownership of the model transfers or the reported information materially changes.
- If you are a large frontier developer, develop a frontier AI framework covering how you set capability thresholds for catastrophic risk, apply and review mitigations before deploying or extensively using a frontier model internally, use third-party assessors, secure unreleased model weights, respond to critical safety incidents, govern these processes internally and manage catastrophic risk from internal use; then implement it, comply with it and publish it on your website.
- If you are a large frontier developer, review your frontier AI framework at least once a year, and within 30 days of a material modification publish the modified framework with a justification.
- Before or when you deploy a new or substantially modified frontier model, publish on your website a transparency report giving your website, a way to contact you, the model's release date, supported languages and output modalities, intended uses and any general restrictions on use; as a large frontier developer, add machine-readable summaries of your catastrophic-risk assessments, their results, the role of third-party evaluators and the other steps you took under your framework.
- If you are a large frontier developer, retain an independent third party every year to audit your compliance with the act; do not retain a party with which you share a financial interest or condition its payment on the result; give the auditor access to the materials it needs; keep an unredacted copy of each audit report for as long as a frontier model is deployed plus five years; and within 30 days publish a high-level summary and a redacted copy of the report and send the redacted copy to the Pennsylvania Emergency Management Agency and the Attorney General.
- Report a critical safety incident involving one of your frontier models to the Pennsylvania Emergency Management Agency and the Attorney General within 72 hours of learning facts sufficient to establish a reasonable belief that it occurred, and disclose an incident that poses an imminent risk of death or serious physical injury within 24 hours to an appropriate authority, including a law enforcement or public safety agency with jurisdiction.
- If you are a large frontier developer, send the Pennsylvania Emergency Management Agency a summary of each assessment of catastrophic risk from internal use of your frontier models every three months, or on another reasonable schedule you have communicated in writing.
- Do not make a materially false or misleading statement about catastrophic risk from your frontier models or your management of it; as a large frontier developer, do not make one about your implementation of or compliance with your frontier AI framework, unless the statement was made in good faith and was reasonable under the circumstances.
- As a large frontier developer, give covered employees a reasonable internal process to disclose, anonymously or otherwise, a specific and substantial danger to public health or safety from catastrophic risk or a violation of the act, with a monthly status update to the person who disclosed; share each disclosure and response with officers and directors at least quarterly; do not prevent or retaliate against a covered employee for a protected disclosure; and give covered employees notice of these rights.
- If you redact a document you publish under the act, describe the character and justification of each redaction in the published version to the extent the reasons for redaction permit, and keep the unredacted information for at least five years.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
As introduced, a large frontier developer that commits a violation listed in section 1303(b) faces a civil penalty that scales with severity and does not exceed $1,000,000 for a first violation and $3,000,000 for a subsequent violation, recovered exclusively in a civil action by the Attorney General. Any other person that violates the act faces a civil penalty of up to $1,000 for each day of violation, plus the agency's fees and costs, after notice and hearing.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 1,000,000
Who enforces it
Enforcement body
Pennsylvania Emergency Management Agency, in consultation with the Attorney General; civil penalties recovered by the Attorney General
What this law does
House Bill 2800 was introduced on and referred to the House Communications and Technology Committee on . It would create the Artificial Intelligence Risk Prevention Act. A frontier model is a foundation model trained using more than a set quantity of computing power. A large frontier developer is one with more than $500,000,000 in annual gross revenues together with its affiliates.
A large frontier developer could not develop, deploy or operate a frontier model in the Commonwealth without first filing a registration form and a current disclosure statement and paying the required fee. Each large frontier developer would have to comply with the frontier AI framework it implements to manage catastrophic risk. A frontier developer would have to publish a transparency report before or when it deploys a new or substantially modified frontier model.
A large frontier developer would have to retain a third party to perform an independent audit of compliance every year. A frontier developer would have to report a critical safety incident to the Pennsylvania Emergency Management Agency and the Attorney General within 72 hours of learning facts sufficient to establish a reasonable belief that one has occurred.
A large frontier developer that violates the act would face a civil penalty of up to $1,000,000 for a first violation and up to $3,000,000 for a subsequent violation. Only the Attorney General could bring the civil action to recover a civil penalty. The bill creates no private right of action. Most of the act would take effect one year after publication of the notice described in section 1504(b)(2).
When LexLint raises it
When your app profile says your app trains models or generates content with AI.