Oct. 20, 2026 — Pennsylvania lawmakers yesterday gave their initial public consideration to two frontier AI model safety bills, both of which were filed in response to the recent spate of alarming rogue AI incidents.

HB 2800, the Artificial Intelligence Risk Prevention Act sponsored by Rep. Melissa Shusterman (D-Chester), would establish a risk prevention and transparency framework for the largest frontier AI model developers. HB 2829, sponsored by Rep. Manuel Guzman, is a very similar bill with a slightly wider scope of incident and a strict prohibition on the deployment of a frontier model with an unreasonable risk of catastrophic harm.

Both offered overviews of their bills yesterday before the Pennsylvania House Communications and Technology Committee. Steve Wimmer, Senior Policy and Technical Advisor with the Transparency Coalition, appeared before the committee to offer his analysis of each bill.

We have an overview of each bill below, followed by excerpts from yesterday’s hearing testimony.

What’s in HB 2800, The Artificial Intelligence Risk Prevention Act

Scope: This bill applies to large frontier AI developers with annual gross revenue greater than $500 million. “Frontier model” is defined as a foundation model trained using computing power more than 10²⁶ integer or floating-point operations. “Catastrophic risk” is defined in alignment with California’s enacted SB 53: More than 50 deaths or injuries, or more than $1 billion in damage.

Requirements: Starting Jan. 1, 2028, covered developers would be required to build a safety framework that incorporates national standards and best practices; includes catastrophic-capability thresholds and mitigations; undergoes pre-deployment and internal-use review; includes a third-party assessment, as well as incident response plans. The framework must be published, followed, and reviewed annually. Material changes must be published with a justification within 30 days.

Transparency reports: Before or at deployment of a new or substantially modified frontier model, every frontier developer must publish basic information: website, contact mechanism, release date, languages, output modalities, intended uses, and use restrictions. Large developers must add summaries of catastrophic-risk assessments, their results, third-party evaluator involvement, and other framework steps, in machine-readable format. A system card or model card satisfies the requirement.

The audit report must cover compliance, internal controls, personnel, conflict-of-interest procedures, and methodology. The developer must publish a summary and redacted report and send it to PEMA and the Attorney General. Redactions are allowed for trade secrets, security, or legal compliance, but must be described, and unredacted versions kept for at least 5 years.

Third-party audit requirement: A large frontier developer must annually retain an independent auditor to check compliance with HB 2800. The auditor must follow generally accepted auditing standards, have frontier-safety expertise, and have no financial interest in either direction. Payment can’t be contingent on results.

Incident reporting requirements: PEMA and the Attorney General will establish a reporting channel open to both developers and the public. Developers must report critical safety incidents within 72 hours of forming a reasonable belief one occurred. If there’s imminent risk of death or serious injury, they must notify an appropriate authority within 24 hours.

Whistleblower protections: Employees handling critical-safety risk may report specific and substantial catastrophic dangers, or violations of the act, to PEMA, the AG, federal authorities, or internal supervisors. Developers can’t restrict these disclosures through policy or contract, and may not retaliate. Notice of rights must be posted or provided annually with acknowledgment.

Large developers must also run an anonymous internal reporting channel, give the reporter monthly status updates, and brief officers and directors quarterly.

Enforcement: PEMA enforces in consultation with the Attorney General. Penalties range from $1,000 per day up to $1 million for a first violation, $3m for subsequent, scaled to severity. There is no private right of action.

Effective date: PEMA must issue temporary regulations within 6 months. The rest of the act takes effect one year after those temporary regulations are published. The bill as drafted requires developers to start implementing the required safety framework on Jan. 1, 2028, but that may conflict with the publication of the PEMA regulations.

What’s in HB 2829, compared to HB 2800

Scope: Same as HB 2800, with the same definitions of large frontier AI model developers and catastrophic risk. HB 2829 contains a broader definition of “incident” than HB 2800.

Requirements: Large frontier developers must implement, publish, and comply with a framework covering the same ten topics as HB 2800. HB 2829 also adds an eleventh: implementing safeguards against unreasonable catastrophic-scale risk. The framework is reviewed annually, material changes are published with a justification within 30 days, and copies go to PEMA and the AG within 30 days, similar to HB 2800.

The model-card-style transparency reports are the same as in HB 2800. Developers must report incidents within 72 hours, or within 24 hours to authorities if there is imminent risk. Reports are exempt from the Right-to-Know Law, and PEMA reports annually starting in 2029.

Deployment ban: HB 2829’s biggest differentiator may be this: A large developer may not deploy a model if its own assessments show deployment would create an unreasonable risk of catastrophic-scale harm.

Third-party audit requirement: As with HB 2800, annual independent audits are required, with the same independence, access, and reporting rules. Developers must also keep test procedures and results detailed enough for a third party to replicate them.

Whistleblower protections: These largely match HB 2800, including the anonymous internal channel. Misrepresentation requires a knowing false statement or omission, a higher bar than HB 2800 sets.

Enforcement: The Attorney General would enforce the Act. There is no private right of action, and local AI regulation of frontier models is preempted. Large developers face up to $1 million for a first violation and $3 million for each later one; the list includes unsafe deployment, missing safeguards, and missing test records.

Bill overviews: Sponsors testify