Do you need to set up your own Customer Identification Program based on the April 28^th AI Executive Order deadline?

Disclaimer: I am not a lawyer, and this article is not intended as legal advice. If you have inquiries regarding the status of your Customer Identification Program’s (CIP) compliance, it's recommended to seek counsel from an attorney. I am a practitioner and director in the field of artificial intelligence (AI) keeping an eye on industry shifts and sharing those insights.

Follow all our coverage on the AI Executive Order here:

• A Seismic Shift: How the U.S. Patent and Trademark Office’s Guidance Could Impact Your Business
• Navigating the AI Executive Order: Key Insights for Businesses as the First Deadline Approaches
• 4 Ways the AI Executive Order May – Or May Not – Impact Your Business

‍

‍

Background

The Executive Order introduced by President Joe Biden on October 30, 2023, contains a wide number of mandates around AI, including federal disclosure, national security analyses, and intellectual property treatment. A proposed rule, pursuant to this Executive Order, outlines how companies must track and verify their foreign customers, including those sold by foreign resellers.

‍

What does this rule propose?

In short, it requires all IaaS providers for AI to implement Customer Identification Programs (“CIP”). These programs require companies selling these services to:

• Verify the identity of all persons and businesses that have access to qualifying clusters and models

• Verify the identity of all “Beneficial Owners” of the businesses or entities outlined in the first point, meaning:

1. Anyone who has “substantial control”

2. Anyone who owns or controls 25% or more of the ownership interests of the customer

3. Disclose when a foreign person contracts an IaaS for model training

4. Proposes the development of new penalties for noncompliance

‍

Who is affected by these requirements?

The criteria for the standard executive order include (1) models and clusters capable of 10^26 operations (or 10^23 for biological models), or (2) a large model that can be used for malicious activity. If you control or own one of these models, you may be subject to these resale requirements. However, since models and clusters of sufficient size are still relatively rare, it is unlikely that the models you've built for your business would qualify.

‍

Have more questions?

We will continue to publish guidance on the impacts of this and future AI regulation. If you’d like to connect with one of our AI experts, we can help you understand how the ongoing rulemaking affects your business, and help you get the most out of your AI! Contact us to learn more.

Subscribe to Concord's blog to stay in the loop on the latest AI regulation news!