The Stop Rogue AI Act is a two-section United States House bill introduced by Representative Josh Gottheimer in the 119th Congress, 2d Session, described on its face as a bill "[t]o provide for certain artificial intelligence agent discovery and security standards, and for other purposes." Section 1 gives the short title. Section 2, headed "AI AGENT DISCOVERY AND SECURITY STANDARDS," is the whole of the operative text: it directs the National Institute of Standards and Technology, coordinating with the Assistant Secretary of Commerce for Communications and Information, to develop and maintain standards for secure AI agent development, deployment and operation, and directs the Federal Acquisition Regulatory Council to propose procurement revisions requiring contractors and agencies to comply. For the bill's sponsorship, origin and reception, see Stop Rogue AI Act (2026).
The bill creates no prohibition, liability, shutdown power or penalty. Its subject is organizational control over AI agents deployed inside information systems, not the capabilities of frontier models.
Status of the text
The copy of record is the version Inside AI Policy posted on 9 September 2026. It is an introduced-form copy prepared before numbering and referral: the header reads "H. R. ll" with the number blank, the referral line reads "Committee on llllllllllllll," and the member signature line is blank. Every page carries the drafting stamp "September 1, 2026 (5:20 p.m.)" with the XML path G:\M\19\GOTTHE\GOTTHE_216.XML. The bill number is therefore still not established.
Only Gottheimer appears on the face of the document; the introduction line reads "Mr. GOTTHEIMER introduced the following bill." Representative Mike Lawler's name does not appear in the text. Accounts describing the measure as a Gottheimer–Lawler bill rest on sources outside this copy, and a co-sponsorship added after this copy was prepared would account for the difference.
The standards duty
Section 2(a)(1) requires the NIST Director, in coordination with the Assistant Secretary, to "develop, publish, and maintain standards, guidelines, and best practices for the secure development, deployment, and operation of artificial intelligence agents by an organization," not later than one year after enactment and annually thereafter. Eight contents are required:
- Capability to "continuously discover, inventory, verify, and maintain organizational control over all AI agents operating within or interacting with" the organization's information systems, networks, applications, services or digital environments.
- Maintenance of organizational control over agents the organization deploys.
- Integration of discovery mechanisms into broader cybersecurity and risk management processes, "consistent with defense-in-depth."
- Consistent application of discovery and verification controls to agents whether developed internally, acquired from third-party vendors or operated through external services.
- Evaluation of agent security, safety, correctness and reliability before deployment and continuously afterwards.
- Continuous runtime monitoring and, where appropriate, "inline detection and interception of AI agent interactions with tools, data sources, information systems, and other AI agents," including detection of prompt injection, data exfiltration, anomalous tool invocation, and "behavioral drift from an AI agent's approved operational baseline."
- Cryptographically verifiable provenance mechanisms "sufficient to identify the entity responsible for creating or operating an AI agent."
- Generation and retention of "tamper-evident, standardized logs of material AI agent actions," portable and accessible as appropriate and consistent with law to deploying organizations and authorized relying parties.
Section 2(a)(2) requires NIST to treat agent discovery "as a necessary component of effective cybersecurity within applicable frameworks, profiles, and reference materials."
Open and interoperable identity
Section 2(a)(3) is the bill's most specific technical direction and is framed against proprietary control. NIST and NTIA are to support "open, vendor-agnostic, and interoperable standards for AI agent discovery mechanisms," promoting "existing internet infrastructure and identity-based discovery mechanisms, including domain name system-based approaches, cryptographically verifiable AI agent identity and registry frameworks, or functionally equivalent mechanisms"; ensuring standards are "globally interoperable, distributed, and not dependent on proprietary or platform-specific registries"; and engaging multistakeholder processes including industry, civil society and technical standards bodies for broad adoption and international coordination.
Section 2(a)(4) sets three minimum organizational requirements the standards must impose on deploying organizations: a continuous machine-readable inventory of all AI agents using standardized vendor-agnostic naming conventions; identity and trust verification mechanisms that are "independent and cryptographically verifiable at both the network and application layers"; and a prohibition on relying "solely on self-attested or single-provider assertions for establishing AI agent identity."
Section 2(a)(5) directs NIST to incorporate the standards into existing NIST frameworks and guidance, to avoid duplicating other NIST agent-standards work, to conduct or support demonstration projects "including through the National Cybersecurity Center of Excellence," to coordinate with NTIA on outreach and international engagement, and to coordinate with the Cybersecurity and Infrastructure Security Agency Director so that agent-discovery standards are "reflected in applicable Federal civilian agency security guidance and binding operational directives, as appropriate" — a route into binding directives at CISA's discretion rather than by mandate.
Procurement as the enforcement channel
Section 2(b)(1) requires the Federal Acquisition Regulatory Council, not later than 18 months after publication of the standards and annually thereafter, to propose Federal Acquisition Regulation revisions requiring contractors and federal agencies procuring or deploying AI agents, or information systems that interact with AI agents, to comply. The 18-month clock runs from publication of the standards, not from enactment, so the earliest FAR proposal falls roughly two and a half years after enactment.
Required contract elements for agent procurement (section 2(b)(2)) include the machine-readable inventory and cryptographically verifiable network- and application-layer identity verification, plus three agency-side guarantees: that discovery and verification capabilities be "accessible to the Federal agency ... without reliance on the contractor"; that the agency be able to exercise organizational control over agent activity, "including the ability to allow, deny, or constrain AI agent-to-AI agent and AI agent-to-information system interactions"; and that the agency be able to provide cryptographically verifiable provenance information to authorized entities interacting with the agent. Tamper-evident standardized logs of material agent actions must be generated, portable and accessible to the contracting agency and, where appropriate, to authorized relying parties. Section 2(b)(3) sets parallel requirements for contracts covering information systems that agents interact with.
Section 2(b)(4) exempts contracts entered into before enactment. Section 2(b)(5) requires the Director of the Office of Management and Budget, with the CISA Director, to issue agency guidance within 180 days of the proposed FAR revisions and annually thereafter, covering implementation of the procurement requirements "including for AI agents deployed through cloud services, platform integrations, or third-party managed environments," and the effective use of agents by agencies in accordance with the standards.
Definitions
Section 2(c) supplies seven definitions. An "artificial intelligence agent" is a software-based system that uses an AI model to perceive, plan or make decisions; "autonomously interacts with other software systems, digital services, users, external environments, or AI agents on behalf of a person or organization"; and "involves minimal or no human interaction beyond its initial direction." "AI agent discovery" is "the technical and organizational capability to identify, enumerate, verify, and maintain a current inventory of AI agents operating within, communicating with, or seeking access to an information system, network, application, service, or digital environment." "Organizational control" is the technical and organizational ability to allow, deny or restrict an agent's access to specific data, the actions it can perform, and the tools, information systems and agents it can use or interact with, together with the ability to "revoke or change at any time" any of those. An "AI model" is "a software component of an information system that implements artificial intelligence technology and uses computational, statistical, or machine-learning techniques to produce outputs from a defined set of inputs." "Defense-in-depth" is defined by enumeration of layered measures. "Information system" takes its meaning from 44 U.S.C. 3502.
Provenance
Captured on 2026-09-12 from the Inside AI Policy document host, complete at 14 pages. Eight divergences and cautions against the secondary accounts the vault previously relied on are recorded in the raw file's ## Source-fidelity notes; the material ones are that the bill number remains unestablished, that Lawler does not appear on the face of the text, that the bill contains no stop mechanism despite its title, and that the procurement clock runs from publication of the standards rather than from enactment.
Relationships
- supports: Stop Rogue AI Act (2026) — the primary text behind the page built from Axios and Inside AI Policy coverage
- related: National Institute of Standards and Technology (NIST) — the standards-setting body, with NTIA as coordinating agency
- related: Cybersecurity and Infrastructure Security Agency (CISA) — regulator role — coordination on federal civilian agency guidance and binding operational directives
- related: NIST AI Agent Standards Initiative (2026) — the agent-security standards work already under way
- depends-on: Agentic AI — the bill's definition of an AI agent turns on autonomous interaction with minimal human involvement beyond initial direction
- related: Autonomous cyber-agents — prompt injection, data exfiltration and behavioral drift as the monitored failure modes
- related: Agent Autonomy Spectrum (5 Levels) — organizational control as a set of revocable permissions over an agent's data, actions and interlocutors
- related: Unintended coordination between AI agents — agent-to-agent interaction as the interface the bill requires agencies be able to constrain
- related: Government AI Procurement — the FAR revision as the bill's enforcement channel
Sources
- Raw source:
Raw Sources/Stop Rogue AI Act - bill text as introduced (Gottheimer, 2026-09-09).md - Bill text PDF: insideaipolicy.com