Anthropic Circulates Draft Federal Bill for Court-Ordered Model Blocks
Anthropic is circulating a draft federal bill that would create a judicial process to block distribution of an AI model in defined catastrophic-risk scenarios. An Anthropic spokesperson confirmed the draft and said it contains proposals from the company's Advanced AI Framework that it has discussed with lawmakers since June, according to reporting published Oct. 20, 2026. TechCrunch
The existence of the outreach first surfaced on Oct. 16, 2026, when Reuters, citing Politico, reported that Anthropic had quietly pitched its own AI safety bill to lawmakers. Reuters The details described on Oct. 20 outline a pre-distribution evaluation and court-order mechanism, not a unilateral agency takedown authority.
Under the draft, independent evaluators registered with the U.S. Commerce Department would assess a model's disaster potential. Evaluators that find an imminent catastrophic risk would have 72 hours to notify the Department. Evaluators could be paid by AI labs, provided payment is not contingent on the results. If notified, the Commerce Department would be required to petition a judge in Washington, D.C., for an order halting release. The draft would expressly forbid any federal agency from halting distribution on its own. No agency could act alone.
The bar is high. A blockable scenario is defined as a foreseeable, imminent risk in which more than 50 people could die or more than $1 billion in property damage could result. The risk must also fall into one of three causal classes: creation or release of a biological weapon, the model evading its developer's controls, or a cyberattack. That scoping matters for practitioners. It excludes general misuse, bias, economic displacement, or lower-severity safety failures from this particular blocking authority, and ties intervention to loss-of-control, weapons-enablement, and offensive cyber pathways.
The thresholds parallel state law. California Senate Bill 53 uses the same figures, 50 deaths and $1 billion in damage, to define catastrophic risk. California's SB 53 also requires frontier AI developers to publish a framework describing how they assess and manage catastrophic risks. TechCrunch Anthropic has published a compliance framework for SB 53 addressing that assessment and management obligation. Anthropic
The draft sits alongside other Anthropic publications on risk measurement. The company published principles for reducing catastrophic risks while supporting innovation in a post titled 'The case for targeted regulation' in October 2024. More recently, it published an August 2026 risk report evaluating the degree to which its systems pose catastrophic risk in several categories, and a September 2026 threat-intelligence report covering threat actors disrupted between December 2025 and August 2026 across seven areas of harm, from cyber operations to biological misuse.
The broader context here is worth spelling out for teams that build and deploy frontier systems. The proposal centralizes the federal blocking function in a single pipeline: registered third-party evaluation, Commerce Department referral, Article III review. In my view, that structure is intended to solve two problems at once, pre-deployment visibility without giving every regulator an off switch, and judicial check on what would otherwise be a highly consequential executive action. The tradeoffs are familiar to anyone who has worked with FedRAMP-style assessment regimes or vulnerability disclosure timelines. Paid-by-developer evaluation with a non-contingency rule preserves access to frontier weights and scaffolding for testing, but puts substantial weight on evaluator independence, registration standards, and liability for missed calls.
Looking at what this means for labs and infrastructure providers, the operational questions would be scope of model coverage, evaluator access rights, evidentiary standard for "foreseeable, imminent," and how a D.C. court handles highly technical, time-sensitive petitions under seal. The 72-hour notification clock and the property-damage and casualty thresholds would also require concrete measurement methods. Counting counterfactual deaths or attributing downstream property damage from model-enabled actions is analytically difficult, especially for general-purpose systems evaluated before deployment.
In my view, a vendor-authored statute will draw scrutiny, however narrowly drawn. That does not make the mechanism uninteresting. A defined, litigable path to pause distribution, limited to bioweapon, loss-of-control, and cyberattack scenarios with quantified harm thresholds, is clearer than open-ended agency discretion. If adopted in some form, it would give safety and policy teams a concrete interface to design for: logging, evaluation harnesses, and pre-release holds that map to an external legal standard rather than internal policy alone.
