The AUTONOMY Act

Executive summary

Current AI policy assumes systems respond to human prompts. Yet autonomous AI agents now generate content without real-time human input, including election-related manipulation. Existing law offers no clear way to assign responsibility when such agents cause harm. The AUTONOMY Act addresses this gap by requiring verifiable provenance, clarifying shared liability among users, developers, and platforms, and distinguishing between individual and broader electoral harms.

This memo recommends that the Commerce Committee introduce and advance the AUTONOMY Act during the 119th Congress to ensure implementation prior to the 2028 federal election cycle.

Definitions

According to the U.S. Government Accountability Office (2020), a deepfake is a video, image, or audio recording that looks or sounds real but has been created or significantly modified using AI. In this policy brief, we use a broader definition that also includes AI-generated text.

A political deepfake is synthetic media presenting plausible and realistic events that never happened, with the purpose of influencing political attitudes, electoral decisions, public policy views, or civic participation. The defining feature is not merely the identity of the person depicted, but the intent or reasonably foreseeable effect of shaping political perception.

For example, a generic synthetic image of a political figure would not automatically constitute a political deepfake. However, a fabricated video depicting a candidate endorsing a specific policy position, engaging in conduct designed to influence voter perceptions, or interacting with a particular demographic group in a manner intended to affect electoral outcomes would qualify.

We use the term Autonomously Generated Deepfakes (AGDs) to describe deepfakes that are created and/or shared by AI-run, public units like social media accounts. Because AGDs may be produced without clear or explicit human prompt, they raise difficult questions about stakeholders.

Problem statement & policy gaps

AGDs, due to their scale and effectiveness, pose significant challenges to the electoral process, including microtargeted persuasion, where autonomous bots generate personalized and emotionally manipulative political messages to influence individual voters (Stockwell, 2024); the large-scale amplification of disinformation through coordinated networks of autonomous agents; and impersonation, in which AI systems misrepresent voters or political candidates, as seen in cases of chatbots falsely posing as public officials to affect election outcomes (Schroeder et al., 2026; Swenson & Weissert, 2024).

Empirical research shows automated bots already play a measurable and growing role in election discourse. Varol et al. (2017) estimate that 9–15% of active Twitter accounts are bots, while Bessi and Ferrara (2016) find that roughly 400,000 likely bot accounts generated nearly 19% of election-related tweets during the 2016 U.S. presidential election. More recently, the Centre for Emerging Technology and Security (2024) documents AI-enabled influence operations in the 2024 UK and European elections, including synthetic personas and coordinated automated networks, demonstrating that AI lowers the cost and increases the sophistication of political manipulation.

Automated agents remain largely unaddressed in existing deepfake frameworks. The TAKE IT DOWN Act, Texas SB-751, and California AB 730 assume a human creator or distributor and do not account for autonomous generative decision systems. EU Article 35 addresses AI-generated risks through red-teaming and system monitoring, but applies primarily to very large online platforms, leaving gaps for autonomous agents operating as users rather than platform affiliates. Similarly, Goldstein et al. (2023) propose a four-stage model—construction, access, dissemination, and belief formation—but do not address liability complexities arising from agent upload, modification, and autonomous operation.

Intended outcomes

We aim to produce a more well-rounded, eightfold liability model that addresses the new concerns caused by autonomous agents. This requires: (1) machine-readable, cryptographically signed provenance for autonomous political content; (2) AI Bill of Materials disclosures for modifications or fine-tuning of high-risk models to ensure chain-of-custody transparency; (3) assignable liability across developers, creators, configurators, uploaders, and platforms when autonomous deepfakes cause electoral harm; (4) expedited detection.

Policy proposal & implementation

We propose an eightfold liability structure: a sixfold production-consumption chain of stakeholders — AI model developer → secondary (substantial) modifier of the agent → uploader of the agent → configurator → social media platform provider → content consumer — plus two review agencies, a Content Credential Agency and Detection Labs.

I. Model developers. Frontier AI developers such as OpenAI and Anthropic should lead in preventing political deepfakes by embedding robust watermarking and fingerprinting to enable reliable detection. Techniques like training-data–based radioactivation can support accountability and election enforcement (Sablayrolles et al., 2020), but detection systems must be safeguarded to prevent reverse engineering and evasion (Yu et al., 2021). Developers should also document model training, modification, and deployment—consistent with EU AI Act–style requirements—to enable traceability of harmful outputs. Official APIs and SDKs should automatically propagate provenance mechanisms and prohibit their removal; material degradation of watermarking or provenance should violate terms of service and trigger suspension (Williams et al., 2025). Continuous adversarial testing and red-teaming are necessary to maintain resilience, with aggregate robustness metrics shared with accredited Detection Labs for external auditing.

II. Secondary modifiers — those who adapt or further modify base models — should be regulated at the model or agent level. Creating or distributing systems designed to autonomously produce harmful content, including political deepfakes, should be prohibited regardless of whether the developer personally deploys them. Regulation should require built-in safeguards that prevent misuse.

III. Configurators who intentionally design system-level prompts to elicit harmful outputs should bear responsibility, including those who provide prompts or objectives that lead to specific unlawful content. Identification should be case-specific: a neutral agent may be misused by a malicious user, directed by an uploader through predefined objectives, or influenced by secondary prompts generated through agent-to-agent interaction (e.g., autonomous multi-agent systems).

IV. Uploaders — people who upload autonomous agents to platforms — must ensure the model has not been previously configured with negative intentions, and monitor the activity of their autonomous agents on platforms such that if an agent produces, e.g., a mass-scale political defamation operation, the uploader can take down the agent if needed.

V. Platform providers — such as X and Instagram — must mitigate harms by: (1) clearly labeling AI-generated content; (2) providing rapid reporting, moderation, and takedown mechanisms for deepfake victims; (3) prioritizing deepfake detection during elections through enhanced monitoring and cross-platform coordination; and (4) identifying and limiting the reach of automated or AGD accounts, especially those spreading political disinformation. AGD accounts can be identified by platform-affiliated detection teams as long as they are created autonomously through platform APIs; improvements in API systems that increase platforms' knowledge of what the API is used to build would yield great productivity in detecting AGD accounts and AGD-run human accounts.

VI. Credential Authorities (provenance infrastructure layer). Accredited authorities would issue and validate signed provenance credentials, maintain public key registries and revocation lists, publish canonicalization and fingerprinting standards, and ensure interoperability across platforms and detection systems. Credential Authorities certify the integrity of provenance claims; they do not regulate speech content. Liability should arise only in cases of fraudulent or negligent mis-certification.

The AI-BOM framework. The Act mandates compliance with the AI Bill of Materials (AI-BOM). Every party in the production chain who modifies a base model must append a signed, machine-readable AI-BOM entry, documenting fine-tuning steps, configuration changes, and dataset provenance using standardized formats such as CycloneDX v1.5 or SPDX 3.0. While the currently used C2PA standard governs content-level provenance, AI-BOM governs model-level provenance.

Legislative precedent. Executive Order 14028 (2021) required federal vendors to provide digitally signed SBOMs disclosing software supply chains, a model echoed in the EU Cyber Resilience Act. An AI-BOM for politically deployed autonomous agents extends this transparency framework to high-risk AI, making voluntary provenance standards legally binding for autonomous political systems.

Existing infrastructure. Industry is already moving in this direction voluntarily. The Hugging Face Model Hub, hosting over 500,000 public models, already tracks fine-tuning lineages, though academic analysis finds that most derivative models carry no formal record of what changed between generations. The AI Lineage Explorer advances this by generating a tamper-proof cryptographic integrity graph documenting a model's complete modification history. Credential Authorities under the AUTONOMY Act would formalize what these voluntary tools have prototyped.

VII. Detection Labs. Accredited, independent labs should benchmark detection tools, publish accuracy and error-rate metrics, maintain calibration curves, conduct adversarial testing, and issue forensic assessments for disputed content. They should also audit platform detection systems and disclose methodological limitations and performance metrics.

VIII. Content consumers must protect their own data by keeping sensitive information and/or media private as much as possible.

Political feasibility and coalition building

Natural allies include election officials, national security–oriented lawmakers concerned about foreign interference, and emerging AI detection and provenance firms. Civil liberties organizations may express concern about overbreadth; however, the Act's focus on traceability rather than speech prohibition mitigates these risks. To broaden bipartisan support, the scope of mandatory watermarking could be limited to high-risk political content or election periods, and compliance thresholds could be phased in for smaller developers.

Enforcement authority. The Act builds on existing federal authority. It aligns with current FEC and FCC AI-related disclosure frameworks, while CISA is positioned to accredit Detection Labs. The FTC can enforce AI-BOM and provenance compliance, the DOJ can address intentional election interference or impersonation, and the FEC retains jurisdiction over campaign-related misrepresentation. The AUTONOMY Act preserves Section 230 protections, conditioning safe-harbor eligibility on compliance with provenance and detection requirements without imposing publisher liability. Its scope is limited to synthetic media that falsely depicts real persons or fabricated events likely to mislead voters, with exemptions for satire and clearly labeled content.

Implementation timeline. Within six months, Commerce—working with NIST and CISA—would formalize AI-BOM standards and accreditation criteria. Covered entities would certify compliance within twelve months, with full enforcement beginning within twenty-four months, ahead of the 2028 election cycle.

Challenges

The central risks to the AUTONOMY Act are technical attribution failure and cumulative misalignment. Even with AI-BOM records and signed provenance manifests, it may be difficult to trace harmful outputs to a specific actor, especially when autonomous systems operate across multiple layers of modification and deployment. Attribution can also fail if developers and platforms adopt incompatible watermarking systems, making credential verification and cross-platform detection ineffective.

Cumulative misalignment poses a broader structural risk. Harmful political content may emerge even when each actor in the liability chain formally complies with its legal duties. A lawful model, lawful modification, lawful configuration, and lawful amplification can still produce destabilizing outcomes when combined. To address this, the framework relies on ongoing risk monitoring and adaptive rulemaking rather than narrow, one-time compliance checks.

# LLM usage: all research, reasoning, and conclusions are original to the authors. An LLM was used solely as a writing aid for clarity and organization.