Deterring American AI Model Theft Act of 2026

Summary

Creates a government effort to identify, report on, and punish foreign actors who steal capabilities from U.S. closed‑source AI models by means like model extraction attacks. It directs State and Commerce to assess attackers and fraudulent account providers, publish guidance and an attackers list, set up confidential reporting and information sharing, and requires Commerce to consider adding offending parties to the Entity List and authorizes the President to block property and transactions under IEEPA. Sets deadlines (180–210 days) for initial assessments, reports, and guidance, establishes technical definitions and who counts as an "entity of concern," and includes procedures and exceptions for enforcement actions and sanctions.

• Requires State and Commerce to assess, report, and publish guidance on foreign model extraction attacks against U.S. closed‑source AI models within 180–210 days.
• Creates a public "AI Model Extraction Attackers List" maintained by the State Department for up to five years, while protecting confidential owner data.
• Directs Commerce to set up voluntary confidential reporting and best‑practice guidance for model owners and operators.
• Allows Commerce to add identified attackers and facilitating affiliates to the Entity List, restricting U.S. exports and reexports to them.
• Authorizes the President, under IEEPA, to block property and transactions of identified entities of concern, subject to specified exceptions.
• Establishes technical and legal definitions (closed‑source model, model extraction attack, fraudulent account network provider, entity/country of concern) to shape enforcement scope.
• Distinguishes legitimate, authorized training from illicit extraction and provides limited carve‑outs for free‑expression internet access services.
• Requires coordination among the Operating Committee for Export Policy, State, Commerce, and other agencies, including possible classified reporting to Congress.