Stop Rogue AI Act (H.R. 10362) introduced in the House

The Stop Rogue AI Act, introduced in the House as H.R. 10362, would direct the National Institute of Standards and Technology to publish standards for discovering, verifying and controlling AI agents, then require federal contractors and agencies to build those standards into procurement.

What it is

H.R. 10362 was introduced in the House of Representatives on September 14, 2026, by Rep. Josh Gottheimer (D-NJ-5) for himself and Rep. Mike Lawler (R-NY-17), and referred to the Committee on Science, Space, and Technology and, in addition, the Committee on Oversight and Government Reform. Its short title, set in Section 1, is "the 'Stop Rogue AI Act'." The bill had not been assigned a number yet when Gottheimer's office first announced it on September 9, 2026; the text above is taken from the bill as formally introduced five days later, which is the only version this record relies on.

What it requires

Section 2 directs NIST's Director, coordinating with the Commerce Department's Assistant Secretary for Communications and Information, to develop and maintain standards, guidelines and best practices for the secure development, deployment and operation of AI agents within one year of enactment and annually after that. Those standards must cover continuous discovery and inventory of AI agents operating on an organization's systems, maintaining organizational control over deployed agents, and runtime monitoring for prompt injection, data exfiltration, anomalous tool use and drift from an agent's approved baseline. NIST must also coordinate with CISA so the standards are reflected in federal civilian agency security guidance and binding operational directives.

Within 18 months of the standards' publication, the Federal Acquisition Regulatory Council must propose FAR revisions requiring contractors and agencies that procure or deploy AI agents to comply with them, including maintaining a machine-readable agent inventory, cryptographically verifiable identity and provenance mechanisms, and tamper-evident logs the contracting agency can access independently of the contractor. The procurement requirement does not reach back to contracts already in force when the bill is enacted.

What security leaders should do

The bill's standards track is voluntary guidance until NIST publishes it and the FAR process catches up, so there is nothing to comply with yet; the near-term relevance is to any organization that sells AI-agent-enabled products or services to the federal government, since the eventual procurement rule would apply to new contracts, not legacy ones. Security leaders at federal contractors should track whether NIST's eventual standard requires agent inventories and provenance logging in a form their current AI-agent deployments cannot already produce, since the bill's procurement language would make that capability a contract requirement rather than a best practice. As of this record, the bill has not been scheduled for a committee vote or floor action beyond its referral; the gottheimer.house.gov announcement names Lawler as the bill's sole cosponsor and gives no timeline for committee action.

See the regulation tracker for how this compares to other AI-agent and agentic-AI rules taking shape across jurisdictions.