Federal officials would develop AI security standards and purchasing rules

The National Institute of Standards and Technology would publish and maintain standards for organizations to use AI agents securely. The standards would cover agents operating within or interacting with organizations' digital systems. The standards would call for testing before deployment and ongoing monitoring afterward. The agency would develop, publish, and maintain the standards within one year after the bill becomes law and annually thereafter.

The Federal Acquisition Regulatory Council would propose security rules for federal contracts to buy or deploy AI agents. Contracts entered into before the bill becomes law would be exempt. Proposed terms would require contractors to track agents, verify their identities, and keep action records that show tampering. Agencies would get independent access to tracking and identity checks, control over agent interactions, and access to action records. The council would propose revisions within 18 months after the standards are published and annually thereafter.

The council would also propose security terms for federal contracts covering systems that interact with AI agents. Contracts entered into before the bill becomes law would be exempt. Contractors would track interacting agents, verify their identities and origins, and keep action records that show tampering. Agencies would get independent access to tracking and verification, control over agent interactions, and access to action records. The council would propose these revisions within 18 months after the standards are published and annually thereafter.