Proposed US law would make AI risk reporting a legal obligation