,i  #aai? ,,congress  #b;d ,session  ,h4
 ,r4 #ajcfb  ,,9 ,,! ,,h\se ,,(         
,,repres5tatives  ,septemb] #ad1        
#bjbf,mr4 ,got!im] 7= himself & ,mr4    
,lawl]7 introduc$ ! foll[+ bill2 :i* 0  
ref]r$ to ! ,committee on ,sci5ce1      
,space1 & ,te*nology1 & 9 addition to ! 
,committee on ,ov]sight & ,gov]nm5t     
,re=m1 = a p]iod to be subsequ5tly      
det]m9$ by ! ,speak]1 9 ea* case =      
consid]ation ( su* provisions z fall )9 
! jurisdiction ( ! committee conc]n$  ,a
 ,,bill  ,to provide = c]ta9 artificial 
intellig5ce ag5t discov]y & security    
/&>ds1 & = o!r purposes4  #a4 ,%ort     
title  ,?is ,act may be cit$ z ! ,/op   
,rogue ,,ai ,act4  #b4 ,,ai ag5t        
discov]y & security /&>ds  7a7 ,,ai ag5t
 discov]y & security /&>ds  7#a7 ,9     
g5]al ,n lat] ?an #a ye> aft] ! date ( !
 enactm5t ( ?is ,act & annually !reaft]1
 ! ,director ( ! ,national ,in/itute (  
,/&>ds & ,te*nology 79 ?is section      
ref]r$ to z ! ,director71 9 coord9ation 
) ! ,assi/ant ,secret>y ( ,comm]ce =    

,communications & ,in=mation 79 ?is     
section ref]r$ to z ! ,assi/ant         
,secret>y71 %all develop1 publi%1 &     
ma9ta9 /&>ds1 guidel9es1 & be/ practices
 = ! secure developm5t1 deploym5t1 &    
op]ation ( artificial intellig5ce ag5ts 
by an organization4 ,su* /&>ds1         
guidel9es1 & be/ practices %all-- 7,a7  
ma9ta9 ! capability to cont9u\sly       
discov]1 inv5tory1 v]ify1 & ma9ta9      
organizational control ov] all ,,ai     
ag5ts op]at+ )9 or int]act+ ) !         
in=mation sy/ems1 networks1             
applications1 s]vices1 or digital       
environm5ts ( su* organizations2  7,b7  
ma9ta9 organizational control ov] ,,ai  
ag5ts deploy$ by su* organization2  7,c7
 integrate discov]y me*anisms into      
broad] cyb]security & risk managem5t    
processes1 consi/5t ) def5se-9-dep?2    
7,d7 apply discov]y & v]ification       
controls consi/5tly across ,,ai ag5ts   
reg>dless ( :e!r su* ,,ai ag5ts are     
develop$ int]nally1 acquir$ f ?ird-p>ty 
v5dors1 or op]at$ ?r\gh ext]nal s]vices2

  7,e7 evaluate ! security1 safety1     
correctness1 & reliability ( ,,ai ag5ts 
be=e su* ,,ai ag5ts are deploy$ by su*  
organization & cont9u\sly aft] su*      
deploym5t2  7,f7 enable cont9u\s runtime
 monitor+ &1 :]e appropriate1 inl9e     
detection & int]ception ( ,,ai ag5t     
int]actions ) tools1 data s\rces1       
in=mation sy/ems1 & o!r ,,ai ag5ts1     
includ+ detection ( prompt injection1   
data exfiltration1 anomal\s tool        
invocation1 & behavioral drift f an ,,ai
 ag5t's approv$ op]ational basel9e2     
7,g7 implem5t cryptographically         
v]ifiable prov5ance me*anisms suffici5t 
to id5tify ! entity responsible = creat+
 or op]at+ an ,,ai ag5t2 &  7,h7 g5]ate 
& reta9 tamp]-evid5t1 /&>diz$ logs (    
mat]ial ,,ai ag5t actions1 & ensure su* 
logs are portable & accessible1 z       
appropriate & consi/5t ) law1 to deploy+
 organizations & au?oriz$ rely+ p>ties4 
7#b7 ,,ai ag5t discov]y z a compon5t (  
cyb]security ,9 c>ry+ out p>agraph 7#a71
 ! ,director1 9 coord9ation ) !         

,assi/ant ,secret>y1 %all include 9 !   
/&>ds1 guidel9es1 & be/ practices       
describ$ 9 su* p>agraph ,,ai ag5t       
discov]y z a necess>y compon5t (        
effective cyb]security )9 applicable    
frameworks1 pr(iles1 & ref]5ce mat]ials4
  7#c7 ,op5 & int]op]able discov]y /&>ds
 ,! ,director1 9 coord9ation ) !        
,assi/ant ,secret>y1 %all support !     
developm5t & adoption ( op51            
v5dor-agno/ic1 & int]op]able /&>ds =    
,,ai ag5t discov]y me*anisms4 ,9 c>ry+  
out ?is p>agraph1 ! ,director & !       
,assi/ant ,secret>y %all-- 7,a7 promote 
! use ( exi/+ int]net infra/ructure &   
id5tity-bas$ discov]y me*anisms1 includ+
 doma9 "n sy/em-bas$ approa*es1         
cryptographically v]ifiable ,,ai ag5t   
id5tity & regi/ry frameworks1 or        
functionally equival5t me*anisms1 to    
enable secure & scalable ,,ai ag5t      
discov]y & ,,ai ag5t id5tity            
v]ification2  7,b7 ensure t su* /&>ds   
are globally int]op]able1 di/ribut$1 & n
 dep5d5t on propriet>y or               

plat=m-specific regi/ries2 &  7,c7      
engage ) multi/akehold] processes1      
includ+ indu/ry1 civil society1 &       
te*nical /&>ds bodies1 to support broad 
adoption & int]national coord9ation4    
7#d7 ,m9imum organizational requirem5ts 
,/&>ds1 guidel9es1 & be/ practices      
develop$ "u ?is subsection %all provide 
t organizations deploy+ ,,ai ag5ts--    
7,a7 ma9ta9 a cont9u\s1 ma*9e-readable  
inv5tory ( all ,,ai ag5ts1 us+ /&>diz$1 
v5dor-agno/ic nam+ conv5tions2  7,b7    
implem5t ,,ai ag5t id5tity v]ification &
 tru/ v]ification me*anisms t are       
indep5d5t & cryptographically v]ifiable 
at bo? ! network & application lay]s2 & 
7,c7 d n rely solely on self-atte/$ or  
s+le-provid] ass]tions = e/abli%+ ,,ai  
ag5t id5tity4  7#e7 ,guidance1          
coord9ation1 & demon/ration projects ,! 
,director1 9 coord9ation ) ! ,assi/ant  
,secret>y1 %all-- 7,a7 incorporate !    
/&>ds1 guidel9es1 & be/ practices       
develop$ "u ?is subsection into exi/+   
,national ,in/itute ( ,/&>ds &          

,te*nology frameworks & guidance2  7,b7 
ensure t /&>ds1 guidel9es1 & be/        
practices develop$ "u ?is subsection are
 consi/5t ) & n duplicative ( o!r ef=ts 
by ,national ,in/itute ( ,/&>ds &       
,te*nology to e/abli% /&>ds relat$ to   
,,ai ag5ts2  7,c7 conduct or support    
demon/ration projects1 includ+ ?r\gh !  
,national ,cyb]security ,c5t] (         
,excell5ce1 to evaluate ! effectiv5ess (
 op5 ag5t discov]y me*anisms2  7,d7     
coord9ate ) ! ,adm9i/rator ( ! ,national
 ,telecommunications & ,in=mation       
,adm9i/ration to promote outrea* &      
adoption ?r\gh multi/akehold] processes 
& int]national engagem5t1 z appropriate2
 &  7,e7 coord9ate ) ! ,director ( !    
,cyb]security & ,infra/ructure ,security
 ,ag5cy ( ! ,dep>tm5t ( ,homel&         
,security to ensure ,,ai ag5t discov]y  
/&>ds are reflect$ 9 applicable ,f$]al  
civilian ag5cy security guidance & b9d+ 
op]ational directives1 z appropriate4   
7b7 ,f$]al procurem5t requirem5ts = ,,ai
 ag5t security  7#a7 ,9 g5]al ,n lat]   

?an #ah mon?s aft] ! publication (      
/&>ds1 guidel9es1 & be/ practices "u    
subsection 7a7 & annually !reaft]1 !    
,f$]al ,acquisition ,regulatory ,c\ncil 
%all propose revisions to ! ,f$]al      
,acquisition ,regulation to require     
contractors & ,f$]al ag5cies procur+ or 
deploy+1 z ! case may be1 ,,ai ag5ts or 
in=mation sy/ems t int]act ) ,,ai ag5ts 
to comply ) su* /&>ds1 guidel9es1 & be/ 
practices4  7#b7 ,requir$ contract      
elem5ts ,revisions propos$ "u p>agraph  
7#a7 %all ensure contracts = !          
procurem5t or deploym5t ( ,,ai ag5ts    
include requirem5ts t ! contractor--    
7,a7 ma9ta9 a cont9u\s1 ma*9e-readable  
inv5tory ( all ,,ai ag5ts deploy$ "u su*
 contract1 us+ /&>diz$1 v5dor-agno/ic   
nam+ conv5tions consi/5t ) /&>ds1       
guidel9es1 & be/ practices develop$ "u  
subsection 7a72  7,b7 implem5t ,,ai ag5t
 id5tity v]ification me*anisms t are    
cryptographically v]ifiable at bo? !    
network & application lay]s2  7,c7      
ensure ,,ai ag5t discov]y & v]ification 

capabilities are accessible to ! ,f$]al 
ag5cy t has ent]$ into su* a contract   
)\t reliance on ! contractor ) :i* su*  
,f$]al ag5cy has s ent]$ into su* a     
contract2  7,d7 enable ! ,f$]al ag5cy t 
has ent]$ into su* a contract to ex]cise
 organizational control ov] ,,ai ag5t   
activity1 includ+ ! ability to all[1    
d5y1 or con/ra9 ,,ai ag5t-to-,,ai ag5t &
 ,,ai ag5t-to-in=mation sy/em           
int]actions2  7,e7 enable ! ,f$]al ag5cy
 t has ent]$ into su* a contract to     
provide cryptographically v]ifiable     
prov5ance in=mation to au?oriz$ entities
 int]act+ ) ! ,,ai ag5t1 consi/5t ) !   
policies ( su* ,f$]al ag5cy2 &  7,f7    
g5]ate tamp]-evid5t1 /&>diz$ logs (     
mat]ial ,,ai ag5t actions1 & ensure su* 
logs are portable & accessible to !     
,f$]al ag5cy t has ent]$ into su* a     
contract &1 :]e appropriate & consi/5t )
 law & su* contract1 au?oriz$ rely+     
p>ties4  7#c7 ,requir$ contract elem5ts 
= in=mation sy/ems int]act+ ) ,,ai ag5ts
 ,revisions propos$ "u p>agraph 7#a7    

%all ensure contracts = ! procurem5t or 
deploym5t ( in=mation sy/ems t ,,ai     
ag5ts int]act ) include requirem5ts t ! 
contractor-- 7,a7 ma9ta9 a cont9u\s1    
ma*9e-readable inv5tory ( all ,,ai ag5ts
 t int]act ) su* an in=mation sy/em1 us+
 /&>diz$1 v5dor-agno/ic nam+ conv5tions 
consi/5t ) /&>ds1 guidel9es1 & be/      
practices develop$ "u subsection 7a72   
7,b7 implem5t id5tity v]ification       
me*anisms t are cryptographically       
v]ifiable = all ,,ai ag5ts t int]act )  
su* an in=mation sy/em2  7,c7 implem5t  
prov5ance v]ification me*anisms t are   
cryptographically v]ifiable = all ,,ai  
ag5ts t int]act ) su* an in=mation      
sy/em2  7,d7 ensure ,,ai ag5t discov]y &
 v]ification capabilities are accessible
 to ! ,f$]al ag5cy t has ent]$ into su* 
a contract )\t reliance on ! contractor 
) :i* su* ,f$]al ag5cy has s ent]$ into 
su* a contract2  7,e7 enable ! ,f$]al   
ag5cy t has ent]$ into su* a contract to
 ex]cise organizational control ov] ,,ai
 ag5ts' ability to int]act ) su* an     

in=mation sy/em1 includ+ ! ability to   
all[1 d5y1 or con/ra9 ,,ai ag5t-to-,,ai 
ag5t int]actions )9 su* an in=mation    
sy/em2 &  7,f7 g5]ate tamp]-evid5t1     
/&>diz$ logs ( mat]ial ,,ai ag5t actions
 )9 su* an in=mation sy/em & ensure su* 
logs are portable & accessible to !     
,f$]al ag5cy t has ent]$ into su* a     
contract &1 :]e appropriate & consi/5t )
 law & su* contract1 au?oriz$ rely+     
p>ties4  7#d7 ,sav+ provision = c]ta9   
contracts ,?is subsection %all n apply  
to contracts = ! procurem5t or          
deploym5t1 z ! case may be1 ( ,,ai ag5ts
 or in=mation sy/ems t int]act ) ,,ai   
ag5ts ent]$ into be=e ! date ( !        
enactm5t ( ?is ,act4  7#e7 ,ag5cy       
guidance ,n lat] ?an #ahj days aft] !   
proposal ( revisions "u p>agraph 7#a7 & 
annually !reaft]1 ! ,director ( ! ,(fice
 ( ,managem5t & ,budget1 9 coord9ation )
 ! ,director ( ! ,cyb]security &        
,infra/ructure ,security ,ag5cy1 %all   
issue guidance to ,f$]al ag5cies reg>d+ 
! foll[+3 7,a7 ,! implem5tation (       

procurem5t requirem5ts "u ?is           
subsection1 includ+ = ,,ai ag5ts deploy$
 ?r\gh cl\d s]vices1 plat=m             
integrations1 or ?ird-p>ty manag$       
environm5ts4  7,b7 ,! effective usage ( 
,,ai ag5ts by su* ,f$]al ag5cies 9      
accordance ) ! /&>ds1 guidel9es1 & be/  
practices "u subsection 7a74  7c7       
,def9itions ,9 ?is section3  7#a7 ,,ai  
ag5t discov]y ,! t]m ,,ai ag5t discov]y 
means ! te*nical & organizational       
capability to id5tify1 enum]ate1 v]ify1 
& ma9ta9 a curr5t inv5tory ( ,,ai ag5ts 
op]at+ )91 communicat+ )1 or seek+      
access to an in=mation sy/em1 network1  
application1 s]vice1 or digital         
environm5t4  7#b7 ,,ai2 ,artificial     
intellig5ce ,! t]ms ,,ai & artificial   
intellig5ce h ! mean+ giv5 ! t]m        
artificial intellig5ce 9 section #ejjb (
 ! ,national ,artificial ,intellig5ce   
,initiative ,act ( #bjbj 7#ae ,u4,s4,c4 
#idja74  7#c7 ,,ai model ,! t]m ,,ai    
model means a s(tw>e compon5t ( an      
in=mation sy/em t implem5ts artificial  

intellig5ce te*nology & uses            
computational1 /ati/ical1 or ma*9e-le>n+
 te*niques to produce outputs f a def9$ 
set ( inputs4  7#d7 ,artificial         
intellig5ce ag5t2 ,,ai ag5t ,! t]ms     
artificial intellig5ce ag5t & ,,ai ag5t 
mean a s(tw>e-bas$ sy/em t--  7,a7 uses 
an ,,ai model to p]ceive1 plan1 or make 
decisions2  7,b7 autonom\sly int]acts ) 
o!r s(tw>e sy/ems1 digital s]vices1     
us]s1 ext]nal environm5ts1 or ,,ai ag5ts
 on behalf ( a p]son or organization2 & 
7,c7 involves m9imal or no human        
int]action beyond its initial direction4
  7#e7 ,def5se-9-dep? ,! t]m            
def5se-9-dep? means ! protection (      
in=mation sy/ems by us+ multiple        
security measures1 includ+ policies1    
proc$ures1 & physical security1 su* z   
antivirus s(tw>e1 firewalls1 anti-spyw>e
 tools1 /rong password policies1        
intrusion detection sy/ems1 biometric   
v]ification1 encryption1 & multi-factor 
au!ntication1 to r$uce ! risk (         
unau?oriz$ access1 data brea*1 or o!r   

successful attack4  7#f7 ,in=mation     
sy/em ,! t]m in=mation sy/em has ! mean+
 giv5 su* t]m 9 section #cejb ( title   
#dd1 ,unit$ ,/ates ,code4  7#g7         
,organizational control ,! t]m          
organizational control means ! te*nical 
& organizational ability to--  7,a7     
all[1 d5y1 or re/rict-- 7i7 an ,,ai     
ag5t's access to specific data2  7ii7 ! 
actions an ,,ai ag5t c p]=m2 &  7iii7 ! 
tools1 in=mation sy/ems1 & ,,ai ag5ts   
:i* an ,,ai ag5t c use or int]act )2 &  
7,b7 revoke or *ange at any "t any ( !  
all[ances1 d5ials1 or re/rictions       
describ$ 9 clauses 7i7 ?r\gh 7iii7 (    
subp>agraph 7,a74