The bill directs the Federal Trade Commission to write binding regulations that require covered entities to submit and, in many cases, publish standardized information about foundation models. The required material ranges from training‑data provenance and model composition to testing results, alignment efforts, operational monitoring, and computational resources, with formatting requirements for human‑ and machine‑readable disclosure and a central FTC-hosted catalogue.
The measure targets systems that meet performance, scale, user, or compute thresholds and treats violations as unfair or deceptive acts enforceable under the FTC Act. It also creates carve‑outs and practical support—an open‑source exemption, a three‑month compliance grace period plus technical assistance for small or new firms, and an annual regulatory review—so the rules aim to be detailed without entirely sidelining smaller innovators.
At a Glance
What It Does
Mandates FTC rulemaking to set disclosure and documentation standards for foundation models, requiring covered entities to submit specified information to the agency and publish certain materials on their own sites and in a central FTC registry in human‑ and machine‑readable formats. It allows redactions for cybersecurity or legal reasons, exempts fully open‑source models, and requires annual updates to the rules.
Who It Affects
Entities that provide foundation models meeting the bill’s thresholds—examples include models with over 10 million monthly users or downloads, models with at least 1 billion parameters, or models trained with compute above 10^26 operations—plus downstream developers that materially change base models via fine‑tuning or APIs. The FTC, auditors, and researchers are also affected as operators of and users of the disclosure portal.
Why It Matters
This creates the first nationwide statutory transparency baseline for high‑capacity AI systems, forcing standardized public documentation of provenance, risk assessments, and safety testing. That changes compliance, procurement, and audit practices for major AI providers and establishes a searchable public record that third‑party researchers and regulators can use.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The bill tasks the FTC with fast‑moving regulatory work: within a year it must write rules, and those rules take effect 90 days after publication. The agency must coordinate with NIST, Commerce, OSTP and outside stakeholders to define what to collect, how to publish it, and how to help smaller firms comply.
The disclosure regime distinguishes three publication channels: material to post on a provider’s own website, material to list in a central FTC page (with machine‑readable fields), and sensitive material submitted only to the FTC under controlled conditions.
Required disclosure elements are technical and programmatic rather than legal boilerplate: providers must explain where training data came from and how it was gathered, give an aggregate breakdown of dataset composition, describe governance and alignment efforts, publish model versioning and knowledge cutoff dates, report on monitoring and incident response, and disclose computational resources used in training and operation. Providers must also report performance on benchmarks and how the model handles higher‑risk subject areas like health, security, elections, and hiring.
The bill permits redactions but requires short justifications for any removed material.The law defines covered entities by objective thresholds—user counts, download instances, model parameter counts, and total compute used—while allowing the FTC to update those thresholds. Downstream models that build on a compliant base model must at minimum link to the base model’s transparency page and refile disclosures if they materially retrain or change the base.
Fully open‑source models are not subject to these rules, and the FTC must publish guidance plus a resources page for non‑covered or downstream deployers.To reduce friction for startups and recent entrants, the bill requires a three‑month penalty grace period starting when the firm first becomes covered, and the FTC must provide a qualified technical contact to help during that window and publish a machine‑readable disclosure template. The agency must report to relevant congressional committees after one year on implementation and update the rules annually with NIST and Commerce input.
The Five Things You Need to Know
The FTC must promulgate final disclosure regulations within 1 year of enactment and those regulations become applicable 90 days after promulgation.
A ‘covered entity’ is triggered by objective thresholds such as over 10,000,000 monthly users, over 10,000,000 monthly download instances, models with at least 1,000,000,000 parameters, or training compute exceeding 10^26 operations; the FTC may revise those thresholds by rule.
Disclosures must include training‑data provenance and collection methods, aggregate dataset composition, data governance, intended uses and limitations, model versioning and knowledge cutoff, adverse‑event monitoring, language support, compute used, and performance on safety‑sensitive tasks (health, national security, elections, hiring, etc.).
Fully open‑source foundation models are exempt from the disclosure rules; downstream models must at least link to a compliant base model’s transparency page and refile disclosures for material retraining or adaptations.
Violations are enforced by the FTC as unfair or deceptive acts under the FTC Act with the same investigatory and penalty authorities; the FTC must give covered entities at least 14 days’ notice before initiating enforcement action.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Short title
Establishes the act’s name: the AI Foundation Model Transparency Act of 2026. This is administrative, but it frames the statute’s focus on so‑called ‘foundation models’ rather than all AI systems, which affects how downstream guidance will be scoped.
FTC rulemaking, consultation, and formats
Directs the FTC to issue regulations within one year using notice‑and‑comment procedures, in consultation with NIST, Commerce, OSTP and stakeholders. The rules must specify what information must be submitted to the FTC, what must be posted publicly by providers, and require a consumer‑friendly website display plus a machine‑readable central FTC listing (including a URL). The provision also allows compliance via existing documents such as model or system cards if they contain the required information.
Required disclosure elements
Lists the substantive items for disclosure: training‑data sources and collection methods; aggregate dataset composition (demographics, languages, attributes) with privacy safeguards; data governance; intended uses and risk profiles; model edits, versioning and knowledge cutoffs; incident detection and response; languages supported; alignment efforts; benchmarked performance and risk‑mitigation behavior; and compute resources. The emphasis is practical: disclosures must enable outside auditors and purchasers to assess provenance, capability, and limitations without exposing sensitive data.
Open‑source exemption and downstream model rules
Declares fully open‑source models exempt from the new disclosure regime. For downstream models built on base models, developers must provide a URL to the base model’s disclosure page and must comply with disclosure obligations for any material retraining or significant adaptation. This creates a traceability rule for model lineage while leaving base model owners primarily accountable.
Small/new business assistance and FTC resources page
Requires the FTC to publish guidance and a machine‑readable template developed with NIST to simplify compliance for smaller firms, offer a single three‑month grace period when an entity first becomes covered, and provide a qualified technical representative to advise during that window. The agency must also create a public resources page with recommended frameworks and tools for developers and deployers that fall outside the covered‑entity definition.
Redactions, timing, updates, and enforcement mechanics
Permits redactions strictly for cybersecurity, public safety, national security or to satisfy other federal law, but requires short justifications for any redaction. The regulations become effective 90 days after promulgation, and the FTC must reassess and update rules within a year of promulgation and annually thereafter. Enforcement treats violations as unfair or deceptive acts under the FTC Act and grants the commission full investigative and remedial powers, while requiring at least 14 days’ notice before an enforcement action.
Reporting and definitions
Mandates a one‑year implementation report to relevant House and Senate committees and codifies many working definitions: foundation model (broad data, self‑supervision, ≥1 billion parameters), inference, covered entity triggers, small business/new business definitions, critical infrastructure reference, and training data definition. These definitions will be central to who rules apply to and how the FTC updates thresholds.
This bill is one of many.
Codify tracks hundreds of bills on Technology across all five countries.
Explore Technology in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Consumer and civil‑rights advocates — gain a centralized, searchable set of disclosures to evaluate bias risks, provenance, and model limitations, improving accountability and evidence for enforcement or litigation.
- Independent researchers and auditors — receive machine‑readable data and benchmark disclosures that facilitate reproducible third‑party testing and public risk assessments.
- Downstream deployers and enterprise customers — can rely on central disclosure pages and model cards to perform vendor risk assessments and faster procurement due diligence, reducing the need for bespoke, costly white‑glove audits.
Who Bears the Cost
- Large AI platform providers and cloud operators — must inventory training sources, produce standardized disclosures, maintain a public transparency page and comply with filings; that increases compliance, legal review, and potential liability costs.
- Small and new companies that meet thresholds — although offered a grace period and assistance, they still face technical documentation burdens, engineering work to collect provenance metadata, and potential delays to deployment.
- The FTC and partner agencies — must build and secure a central public registry, staff technical assistance programs, evaluate redactions, and run annual reassessments, all of which will require sustained budget and technical expertise.
Key Issues
The Core Tension
The bill pits two legitimate objectives: public accountability and risk reduction through transparency versus protection of trade secrets, user privacy, and cybersecurity. More granular disclosures aid oversight and third‑party evaluation but also increase the chance of exposing proprietary techniques or operational vulnerabilities, forcing regulators to choose how much transparency is enough to be useful without causing new harms.
The bill aims to make high‑capacity models intelligible to outside parties, but the operational work is complex. Determining what counts as a sufficient disclosure of training provenance without disclosing proprietary datasets or PII will require detailed guidance and likely iterative litigation.
The permitted redaction regime mitigates some security and IP concerns, but short justifications for redactions may produce disputes over adequacy and could push firms to over‑redact, undermining the transparency intent.
The statute uses objective technical thresholds (user counts, download instances, parameter counts, and a compute‑operations metric) to identify covered entities, which helps clarity but creates edge cases. Parameter counts and compute totals are imperfect proxies for risk: a smaller or specialized model can be high‑risk while a larger model may be benign in a given deployment.
The open‑source exemption both reduces compliance burdens for many projects and creates a potential perverse incentive to publish models as open source to avoid disclosure, or conversely to host minimally controlled forks that evade oversight. Finally, centralizing disclosures raises its own attack surface: the FTC will need to secure and govern the repository to avoid creating a single point of vulnerability or a repository of sensitive meta‑information that could be abused.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.