H.R. 10362: Stop Rogue AI Act

This bill would direct the federal government to create and update standards for how organizations should find, identify, monitor, and control AI agents—software systems that use AI to act on their own or with little human involvement.

What the bill would require federal agencies to do

Within one year, the National Institute of Standards and Technology (NIST), working with the Commerce Department’s communications office, would have to develop and maintain standards, guidelines, and best practices for the secure development, deployment, and operation of AI agents. These standards would need to cover things like:

• Keeping a current inventory of all AI agents in an organization’s systems
• Verifying which AI agents are present and who operates them
• Applying these controls whether the AI agent was built internally, bought from a vendor, or accessed through an outside service
• Checking the security, safety, accuracy, and reliability of AI agents before and after deployment
• Monitoring AI agents while they run, including detecting prompt injection, data theft, unusual tool use, or changes in behavior
• Using cryptographic methods to show where an AI agent came from and who is responsible for it
• Keeping tamper-evident logs of important AI agent actions that can be shared with authorized parties when appropriate

Cybersecurity and interoperability requirements

The bill says AI agent discovery should be treated as part of cybersecurity. It also directs NIST to support open, vendor-neutral, and interoperable discovery standards rather than systems tied to one company or platform. It encourages use of existing internet infrastructure, like domain name system-based approaches, and coordination with industry, technical standards groups, civil society, and international partners.

Requirements for federal procurement

After the standards are published, the Federal Acquisition Regulatory Council would have to propose changes to federal contracting rules so that federal agencies and contractors using AI agents, or systems that interact with AI agents, must follow the standards.

For federal contracts involving AI agents, the bill would require contractors to:

• Keep a live, machine-readable inventory of AI agents
• Use cryptographically verifiable identity checks
• Make discovery and verification available to the federal agency, not just the contractor
• Allow the agency to control whether AI agents can act or interact with other systems or AI agents
• Provide verifiable information about where the AI agent came from, when appropriate
• Create and preserve standardized, tamper-evident logs

For contracts involving information systems that AI agents interact with, similar requirements would apply, including inventory, identity and provenance verification, agency access to discovery tools, control over interactions, and logging.

Exceptions and guidance

The procurement requirements would not apply to contracts already in place before the law takes effect. The Office of Management and Budget, together with the Cybersecurity and Infrastructure Security Agency, would also have to issue guidance to federal agencies on how to carry out these procurement requirements and use AI agents in line with the NIST standards.

Definitions

The bill defines an AI agent as a software-based system that uses an AI model to perceive, plan, or make decisions, interacts with other systems or users on its own or with minimal human involvement, and acts on behalf of a person or organization. It also defines terms like AI model, AI agent discovery, defense-in-depth, information system, and organizational control.

Relevant Companies

None found