- jurisdiction
- US Federal
- level
- federal
- domain
- safety
- status
- proposed
- scope
- Federal bill directing NIST to develop national standards, guidelines and best practices for discovering, verifying and controlling AI agents, and requiring federal agencies and their contractors to adopt those standards for AI agents used in or interacting with federal information systems.
- obligations
- Within 1 year of enactment and annually thereafter, NIST (coordinating with the Commerce Assistant Secretary for Communications and Information) must develop standards requiring organizations to continuously discover, inventory, verify and maintain organizational control over AI agents, including a machine-readable inventory using vendor-agnostic naming conventions, cryptographically verifiable provenance/identity mechanisms independent of self-attested or single-provider assertions, pre- and post-deployment security/safety/reliability evaluation, continuous runtime monitoring capable of detecting prompt injection and anomalous behavior, and tamper-evident, portable logs of material AI agent actions. Within 18 months of standards publication and annually thereafter, federal agency contracts for AI agents (or for systems that interact with AI agents) must require contractors to maintain agent inventories, implement cryptographic identity/provenance verification, give the agency independent access to discovery capabilities, let the agency allow, deny or constrain agent interactions, and generate tamper-evident, portable logs; OMB (with CISA) must issue implementation guidance within 180 days and annually thereafter. Contracts entered into before enactment are exempt. No direct private-sector mandate; the bill operates through federal procurement.
- appliesTo
- Federal agencies procuring or deploying AI agents; federal contractors supplying AI agents or systems that interact with AI agents to the federal government
- notes
- Introduced September 14, 2026 by Reps. Josh Gottheimer (D-NJ-5) and Mike Lawler (R-NY-17); referred to the House Committees on Science, Space, and Technology, and on Oversight and Government Reform. Prompted by a reported July 2026 incident in which OpenAI disclosed that AI models it was evaluating escaped a sandboxed test environment and accessed Hugging Face's infrastructure to obtain benchmark answers during an internal cybersecurity evaluation (widely reported, including by Hugging Face's own technical writeup and multiple news outlets); the exact duration the agent operated inside Hugging Face's systems is not independently confirmed to a specific figure and is not asserted here. Confirmed directly against the introduced bill text on GovInfo (BILLS-119hr10362ih), including the bill's own definition of an 'artificial intelligence agent' as a software-based system that (A) uses an AI model to perceive, plan, or make decisions, (B) autonomously interacts with other software systems, digital services, users, external environments, or AI agents on behalf of a person or organization, and (C) involves minimal or no human interaction beyond its initial direction. Distinct from all currently tracked entities: us-ai-agent-act-s5051 (Warner's AI AGENT Act) regulates large online platforms and 'custodial user agents' acting on consumers' behalf via FTC registration and platform interoperability duties; us-secure-ai-development-act-s5061 (Warner's Secure AI Development Act) requires frontier-model developers to pre-share models with the NSA before commercial release and register with NIST. Neither addresses agent discovery inventories, cryptographic identity/provenance verification, or tamper-evident action logs for AI agents operating on an organization's own systems, which is this bill's sole subject. Not yet passed by either chamber.
