Two Pennsylvania House bills would require large frontier AI developers to publish safety frameworks and get audits, and frontier developers to report critical safety incidents

Key takeaways

• Both bills are in the House Communications and Technology Committee. Neither is law.
• HB 2829 would take effect 1 January 2028. HB 2800 sections 1504 and 1505 would take effect immediately and the remainder one year after the notice under section 1504(b)(2); its section 302 filing date is printed as 1 January 2027.
• Both would require critical safety incident reports within 72 hours, and within 24 hours to an appropriate authority where there is imminent risk of death or serious physical injury.
• Both cap civil penalties for a large frontier developer at $1,000,000 for a first violation and $3,000,000 for a subsequent one, and neither creates a private right of action.

Are the Pennsylvania frontier AI bills law, and where do they stand?

No. HB 2829 and HB 2800 are House bills. The bill page for HB 2829 shows its last action as referral to the Communications and Technology Committee on 5 October 2026. HB 2800 shows referral to the same committee on 23 September 2026. For both, the page lists committee report, third consideration, Senate steps and executive action as not yet reached, and HB 2829 shows no votes.

The HB 2829 page also lists a 19 October 2026 committee meeting described as a "Public hearing on Mitigating Risks from Frontier AI Models: HB 2800 and HB 2829." We did not open a transcript, testimony or any account of what was said. HB 2829 is titled in section 101: "This act shall be known and may be cited as the Frontier Artificial Intelligence Safety, Transparency and Accountability Act." Everything below describes the printed text and would change if the bills are amended.

Who would the bills cover, and what is a catastrophic risk?

HB 2829 section 103 says it would apply only to frontier models developed, deployed or operating in whole or in part in Pennsylvania, and that it would not impose a requirement on a person solely because the person works with a model that is not a frontier model. It defines a frontier model as a foundation model trained with more than 10^26 integer or floating-point operations, counting later fine-tuning and reinforcement learning. A large frontier developer is one that, with its affiliates, had annual gross revenues above $500,000,000 in the preceding calendar year. HB 2800 uses the same revenue test; we did not verify its compute threshold.

Both bills define catastrophic risk as a foreseeable and material risk that a developer's frontier model will materially contribute to the death of, or serious injury to, more than 50 people, or more than $1,000,000,000 in property damage or loss, from a single incident. Both bills say loss of equity value does not count as property damage or loss. HB 2829 lists three triggering behaviours: expert-level help with a chemical, biological, radiological or nuclear weapon; conduct with no meaningful human oversight that is a cyberattack or would be murder, assault, extortion or theft if a human did it; and evading the control of the developer or user. HB 2829 excludes information a frontier model outputs only where it is otherwise publicly accessible in a substantially similar form from a source other than a foundation model, lawful activity of the Federal Government, and harm where the model did not materially contribute.

What duties would HB 2829 place on frontier developers?

Under HB 2829, a large frontier developer would, beginning 1 January 2028 for the framework, write, implement, comply with and publish a frontier AI framework (section 501), review it at least once a year, send the framework to the agency and the Attorney General within 30 days of first publication or a material change (section 502), and, beginning 1 January 2028 or 90 days after first qualifying as a large frontier developer, whichever is later, retain an independent third-party audit each year (section 504). The audit report would be summarized and published, with redactions, within 30 days of receipt. Section 505 would require a summary of internal-use catastrophic risk assessments to the agency every three months or on another agreed schedule. Section 506 would bar deployment of a frontier model where the framework and assessments show deployment would create an unreasonable risk of the harms above.

Any frontier developer would have to publish a transparency report before or with deploying a new or substantially modified frontier model (section 701). Large developers would add summaries of catastrophic risk assessments, results and third-party involvement, in machine-readable format. For incidents, section 702(c) would require a report to the Pennsylvania Emergency Management Agency (PEMA) and the Attorney General "within 72 hours" of learning facts sufficient to establish a reasonable belief that a critical safety incident has occurred, and within 24 hours to an appropriate authority where an incident poses an imminent risk of death or serious physical injury. Section 104 would also require large developers to hold a current disclosure statement and pay fees beginning 1 January 2028, and section 1103 would protect covered employees who report safety dangers or violations.

How do the penalties work, and how does HB 2800 differ?

HB 2829 section 1105 would subject a large frontier developer to a civil penalty of up to $1,000,000 for a first violation and up to $3,000,000 for a subsequent violation, for failures such as missing documents, a deployment barred by section 506, a missed audit, a missed incident report or non-compliance with its own framework. The Attorney General could sue for penalties and seek injunctive or declaratory relief, and the section says it does not create a private right of action. Separately, section 104(d) would let PEMA, after notice and hearing, charge $1,000 for each day a large developer fails to file a required disclosure statement or correct false information.

HB 2800 has a similar structure but different timing. Its section 302 would bar a large frontier developer from operating a frontier model in the Commonwealth without a filed registration form and disclosure statement beginning 1 January 2027. Framework implementation (section 501) would begin 1 January 2028, and the annual audit (section 701) would begin 1 January 2028 or 90 days after a developer first qualifies, whichever is later. Section 1304 sets the same $1,000,000 and $3,000,000 caps, recovered by the Attorney General, plus an agency penalty of up to $1,000 a day for violations of section 1303(a). Under section 1505, section 1504 and section 1505 itself would take effect immediately, and the remainder of the act one year after publication of the notice under section 1504(b)(2). HB 2829 also contains a section 1109 giving a developer that first qualifies as a large frontier developer after the effective date 90 days to comply with Chapter 5, and two provisions with no counterpart in the HB 2800 table of contents: section 1101 on declaring intent to comply through designated federal standards, and section 1107 on Commonwealth preemption of local rules on frontier models.

What should AI developers and policy teams do now?

Nothing is required yet. A team that trains or deploys large models and has Pennsylvania users or operations can use the two bills to test its readiness.

• Check whether your training compute and revenue would put you above the 10^26 and $500,000,000 thresholds in HB 2829.
• Compare your current safety framework and model-release reports with the eleven topics in HB 2829 section 501 and the transparency report fields in section 701.
• Check whether your incident process could meet a 72-hour clock, including who decides that a reasonable belief exists.
• Review whistleblower channels, including an anonymous internal route and the employee notice duty (continuous workplace posting with equivalent notice for new and remote employees, or written notice at least once a year with acknowledgment).
• Follow committee action on both bills, since the two texts differ on start dates and some provisions, and the final text could differ again.

What we did not verify

What we opened: the HB 2829 and HB 2800 bill pages and the printed bill texts (PN 4002 and PN 3904) on the Pennsylvania General Assembly website, on 25 October 2026. We read HB 2829 in full. For HB 2800 we read the table of contents, the definitions of large frontier developer and catastrophic risk, and the sections on disclosure timing, framework implementation, audits, incident reporting, whistleblowers, penalties and effective date.

What we did not open: the co-sponsorship memos, any hearing testimony or transcript, amendments, any fiscal note, and the remaining HB 2800 sections, including its transparency report and catastrophic risk reporting provisions. We did not compare the bills with the laws of other states line by line.

What we refuse to claim: that either bill will pass, that any date will hold, that the hearing changed the text, or how PEMA or the Attorney General would enforce either bill.

Related briefings

• AI Regulation News hub
• North America AI regulation tracker
• California SB 53 frontier AI transparency law in force
• Illinois SB 315 AI Safety Measures Act and frontier audits
• New York RAISE Act and frontier developer registration
• Oregon EO 26-26 frontier AI procurement and third-party review