H.R. 10873: AI Cyber Defense Act

This bill would direct the National Institute of Standards and Technology (NIST) to work with private-sector AI companies and other stakeholders to develop voluntary standards and best practices in two related areas:

• AI distillation attacks — NIST would first seek to define what these attacks are and then develop ways to detect and prevent them.
• Using AI for cybersecurity defense — NIST would create a roundtable called the AI Cybersecurity Roundtable to develop best practices for using AI to defend computer systems against cyber threats.

The bill would require NIST to start these efforts within 180 days after the law takes effect. It would also require NIST to publish the resulting voluntary standards and best practices on its website within one year after they are developed.

The roundtable would be expected to include representatives from:

• Private companies involved in artificial intelligence
• Owners and operators of critical infrastructure, such as utilities, communications systems, transportation networks, and similar sectors

The bill defines several terms to clarify who and what is covered. In particular, it defines a "country of concern" to include China, Russia, Iran, North Korea, and Cuba. It also defines an "entity of concern" in a way that generally includes foreign entities headquartered in, controlled by, or affiliated with those countries, while excluding U.S. citizens and lawful permanent residents.

Overall, the bill does not impose mandatory rules or penalties. Instead, it directs NIST to coordinate with industry and publish guidance intended to help companies and critical infrastructure operators reduce risks from AI-related attacks and improve cyber defense practices.

Relevant Companies

• None found