BIS Proposes KYC And Other Cybersecurity Requirements On Cloud Services And AI Training

On January 29, 2024, the Commerce Department's Bureau of Industry and Security (BIS) published a notice of proposed rulemaking (NPRM) introducing a Customer Identification Program (CIP) and other requirements applicable to U.S. providers and foreign resellers of Infrastructure as a Service (IaaS) products. The proposal also includes reporting requirements covering foreign transactions with U.S. cloud services to train "dual-use" AI foundational models that may enable malicious cyber activity. The NPRM implements Executive Orders addressing threats to U.S. critical infrastructure or national security posed by malicious, cyber-enabled activities.

The Commerce Department is soliciting comment on the proposed rules for 90 days, with submissions due to the agency by April 29, 2024. Key features of the NPRM and areas for comment are summarized below.