H.R. 9546

119 HR 9546 IH: Cloud Security Act
 U.S. House of Representatives
 2026-06-30
 text/xml
 EN
 Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.
 I  119th CONGRESS  2d Session  H. R. 9546  IN THE HOUSE OF REPRESENTATIVES   June 30, 2026   Mr. Gottheimer  (for himself and  Mr. Moolenaar ) introduced the following bill; which was referred to the  Committee on the Judiciary    A BILL
To provide for exceptions for notifications to the United States Government relating to specified foreign entities.
1.
Short title
This Act may be cited as the   Cloud Security Act  .
2.
Exceptions for notifications to the United States Government relating to specified foreign entities
(a)
Communications
Section 2702(b) of title 18, United States Code, is amended—
(1)
in paragraph (8), by striking  ; or  and inserting a semicolon;
(2)
in paragraph (9), by striking the period at the end and inserting  ; or ; and
(3)
by adding at the end the following:
(10)
to the Secretary of Commerce, or an officer, employee, or agent of the United States Government designated by the Secretary of Commerce, if—
(A)
the disclosure is made for the purpose of providing a verification, notification, referral, report, or other information required to comply with regulations issued pursuant to the Export Control Reform Act of 2018 ( 50 U.S.C. 4801 et seq. );
(B)
the provider, in good faith, believes that the communication relates to use of a covered cloud product by a specified foreign entity, or by an entity acting on behalf of, at the direction of, or for the benefit of a specified foreign entity; and
(C)
the disclosure is limited to the contents reasonably necessary to make or substantiate the verification, notification, referral, report, or other information described in subparagraph (A).
 .
(b)
Customer records
Section 2702(c) of title 18, United States Code, is amended—
(1)
in paragraph (6), by striking  ; or  and inserting a semicolon;
(2)
in paragraph (7), by striking the period at the end and inserting  ; or ; and
(3)
by adding at the end the following:
(8)
to the Secretary of Commerce, or an officer, employee, or agent of the United States Government designated by the Secretary of Commerce, if—
(A)
the disclosure is made for the purpose of providing a verification, notification, referral, report, or other information required or authorized under the Act that enacted this paragraph, or to comply with regulations issued pursuant to the Export Control Reform Act of 2018 ( 50 U.S.C. 4801 et seq. );
(B)
the provider, in good faith, believes that the record or other information relates to use of a covered cloud product by a specified foreign entity, or by an entity acting on behalf of, at the direction of, or for the benefit of a specified foreign entity; and
(C)
the disclosure is limited to the record or other information reasonably necessary to make or substantiate the verification, notification, referral, report, or other information described in subparagraph (A).
 .
(c)
Definitions
Section 2711 of title 18, United States Code, is amended—
(1)
in paragraph (3)(C), by striking  and  at the end;
(2)
in paragraph (4), by striking the period at the end and inserting  ; and ; and
(3)
by adding at the end the following:
(5)
the term  AI model  means an artificial intelligence model that is trained on broad data, generally uses self-supervision, contains at least 1,000,000,000 parameters, and is applicable across a wide range of contexts;
(6)
the term  covered cloud product  means—
(A)
an infrastructure as a service product used to develop or deploy an advanced AI model using a covered integrated circuit; or
(B)
a platform as a service or software as a service product that provides a customer with computational resources, access, or functionality substantially equivalent to those available through an infrastructure as a service product described in subparagraph (A), regardless of how the product is marketed, packaged, or characterized;
(7)
the term  covered integrated circuit —
(A)
means, subject subparagraph (B)—
(i)
an integrated circuit, computer, or other product—
(I)
classified under Export Control Classification Number 3A090 or 4A090 or related Export Control Classification Numbers; or
(II)
that is functionally equivalent or substantially similar to a circuit, computer, or product described in subclause (I), including certain similar products listed under Export Control Classification Number 5A002.z; or
(ii)
an integrated circuit that has 1 or more digital processing units with—
(I)
a total processing performance of 4,800 or more;
(II)
a total processing performance of 2,400 or more and a performance density of 1.6 or more;
(III)
a total processing performance of 1,600 or more and a performance density of 3.2 or more; or
(IV)
a total DRAM bandwidth of 1,400 gigabytes per second or more, interconnect bandwidth of 1,100 gigabytes per second or more, or a sum of DRAM bandwidth and interconnect bandwidth of 1,700 gigabytes per second or more;
(B)
has the meaning given such term in subparagraph (A), as modified by the Secretary of Commerce beginning 24 months after the date of enactment of this paragraph;
(C)
includes a product containing such a covered integrated circuit;
(D)
does not include a covered integrated circuit or a product containing such a covered integrated circuit that is not designed or marketed for use in data centers; and
(8)
the term  specified foreign entity  has the meaning given that term in  section 7701(a)(51)(B)  of the Internal Revenue Code of 1986.
 .