Cloud Security Act

This Act may be cited as the “Cloud Security Act”.

(a) Communications.— Section 2702(b) of title 18, United States Code, is amended—

(1) in paragraph (8), by striking “; or” and inserting a semicolon;

(2) in paragraph (9), by striking the period at the end and inserting “; or”; and

(3) by adding at the end the following:

“(10) to the Secretary of Commerce, or an officer, employee, or agent of the United States Government designated by the Secretary of Commerce, if—

(A) the disclosure is made for the purpose of providing a verification, notification, referral, report, or other information required to comply with regulations issued pursuant to the Export Control Reform Act of 2018 (50 U.S.C. 4801 et seq.);

(B) the provider, in good faith, believes that the communication relates to use of a covered cloud product by a specified foreign entity, or by an entity acting on behalf of, at the direction of, or for the benefit of a specified foreign entity; and

(C) the disclosure is limited to the contents reasonably necessary to make or substantiate the verification, notification, referral, report, or other information described in subparagraph (A).”.

(b) Customer records.— Section 2702(c) of title 18, United States Code, is amended—

(1) in paragraph (6), by striking “; or” and inserting a semicolon;

(2) in paragraph (7), by striking the period at the end and inserting “; or”; and

(3) by adding at the end the following:

“(8) to the Secretary of Commerce, or an officer, employee, or agent of the United States Government designated by the Secretary of Commerce, if—

(A) the disclosure is made for the purpose of providing a verification, notification, referral, report, or other information required or authorized under the Act that enacted this paragraph, or to comply with regulations issued pursuant to the Export Control Reform Act of 2018 (50 U.S.C. 4801 et seq.);

(B) the provider, in good faith, believes that the record or other information relates to use of a covered cloud product by a specified foreign entity, or by an entity acting on behalf of, at the direction of, or for the benefit of a specified foreign entity; and

(C) the disclosure is limited to the record or other information reasonably necessary to make or substantiate the verification, notification, referral, report, or other information described in subparagraph (A).”.

(c) Definitions.— Section 2711 of title 18, United States Code, is amended—

(1) in paragraph (3)(C), by striking “and” at the end;

(2) in paragraph (4), by striking the period at the end and inserting “; and”; and

(3) by adding at the end the following:

“(5) the term “AI model” means an artificial intelligence model that is trained on broad data, generally uses self-supervision, contains at least 1,000,000,000 parameters, and is applicable across a wide range of contexts;

(6) the term “covered cloud product” means—

(A) an infrastructure as a service product used to develop or deploy an advanced AI model using a covered integrated circuit; or

(B) a platform as a service or software as a service product that provides a customer with computational resources, access, or functionality substantially equivalent to those available through an infrastructure as a service product described in subparagraph (A), regardless of how the product is marketed, packaged, or characterized;

(7) the term “covered integrated circuit”—

(A) means, subject subparagraph (B)—

(i) an integrated circuit, computer, or other product—

(I) classified under Export Control Classification Number 3A090 or 4A090 or related Export Control Classification Numbers; or

(II) that is functionally equivalent or substantially similar to a circuit, computer, or product described in subclause (I), including certain similar products listed under Export Control Classification Number 5A002.z; or

(ii) an integrated circuit that has 1 or more digital processing units with—

(I) a total processing performance of 4,800 or more;

(II) a total processing performance of 2,400 or more and a performance density of 1.6 or more;

(III) a total processing performance of 1,600 or more and a performance density of 3.2 or more; or

(IV) a total DRAM bandwidth of 1,400 gigabytes per second or more, interconnect bandwidth of 1,100 gigabytes per second or more, or a sum of DRAM bandwidth and interconnect bandwidth of 1,700 gigabytes per second or more;

(B) has the meaning given such term in subparagraph (A), as modified by the Secretary of Commerce beginning 24 months after the date of enactment of this paragraph;

(C) includes a product containing such a covered integrated circuit;

(D) does not include a covered integrated circuit or a product containing such a covered integrated circuit that is not designed or marketed for use in data centers; and

(8) the term “specified foreign entity” has the meaning given that term in section 7701(a)(51)(B) of the Internal Revenue Code of 1986.”.