Stop Rogue AI Act (H.R.10362)

Applies To

Overview

Representative Josh Gottheimer introduced the Stop Rogue AI Act, H.R.10362, on 14 September 2026, with Representative Mike Lawler as cosponsor. It was referred to the House Science, Space, and Technology Committee and the Oversight and Government Reform Committee. Within a year of enactment, and every year after, NIST would publish standards and best practices for the secure development, deployment, and operation of AI agents. They would cover discovering, inventorying, and verifying agents, keeping organizational control over them, and building discovery into cybersecurity and risk management. NIST would coordinate with CISA so the standards feed federal civilian security guidance and binding operational directives. Within 18 months of the standards, the Federal Acquisition Regulatory Council would propose rules requiring federal agencies and contractors that buy or deploy AI agents to follow them. Contracts would require a continuous, machine-readable agent inventory, identity verification, agency control over agent activity, and logging. The bill puts no direct duties on private companies outside federal contracting.

Key Requirements

• •NIST must publish AI agent security standards within 1 year of enactment and update them yearly.
• •The standards cover discovering, inventorying, and verifying AI agents and keeping organizational control over them.
• •NIST coordinates with CISA so the standards feed federal security guidance and binding operational directives.
• •Within 18 months of the standards, the FAR Council must propose rules requiring compliance in federal contracts.
• •Contracts would require agent inventories, identity verification, agency control over agent activity, and logging.
• •The bill puts no direct duties on private companies outside federal contracting.

What Your Organization Must Do

• →Track H.R.10362 in committee; it is an introduced bill with no current duties.
• →Map which AI agents already operate in or interact with your systems.
• →Start a continuous, machine-readable inventory of in-house and third-party agents.
• →Check federal contract exposure, since contractors would be affected first if enacted.
• →Watch for NIST standards and later Federal Acquisition Regulatory Council proposed rules.
• →Compare agent controls already expected of deployers under the EU AI Act.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Governance Controls

Operational controls that implement requirements from this regulation.

Frequently Asked Questions

Does the Stop Rogue AI Act impose obligations on private companies?

Not directly: it tasks NIST with standards and then requires them in federal contracts, so federal contractors deploying AI agents would be affected first.

What is the deadline for NIST to publish AI agent standards under this bill?

NIST must publish the standards within 1 year of enactment and update them every year. The FAR Council then has 18 months to propose contract rules.

What does agent discovery mean under the Stop Rogue AI Act and what would it require operationally?

Agent discovery means being able to find and inventory every AI agent operating in or interacting with your systems. That includes third-party agents embedded in business workflows, not only those built in-house.

How does the Stop Rogue AI Act compare to the EU AI Act for companies managing agentic AI systems?

The EU AI Act already applies to providers and deployers. The Stop Rogue AI Act is an introduced US bill that sets standards through NIST and applies them through federal contracts.

Will federal contractors face additional AI agent requirements if the Stop Rogue AI Act becomes law?

Yes, the FAR Council would require contractors deploying AI agents to keep agent inventories and verify agent identity. Contracts would also require agency control over agent activity and logging.

What control requirements does the Stop Rogue AI Act set for AI agents?

The bill speaks of organizational control rather than human control. Standards must let organizations keep control over agents they deploy and agents that interact with their systems.