(a)(1) 1 IN GENERAL.—Not later than 1 year after the date of the enactment of this Act and annually thereafter, the Director of the National Institute of Standards and Technology (in this section referred to as the ''Director''), in coordination with the Assistant Secretary of Commerce for Communications and Information (in this section referred to as the ''Assistant Secretary''), shall develop, publish, and maintain standards, guidelines, and best practices for the secure development, deployment, and operation of artificial intelligence agents by an organization. Such standards, guidelines, and best practices shall— (A) maintain the capability to continuously discover, inventory, verify, and maintain organizational controlorganizational controlThe term ‘‘organizational control’’ means the technical and organizational ability to— (A) allow, deny, or restrict— (i) an AI agent’s access to specific data; (ii) the actions an AI agent can perform; and (iii) the tools, information systems, and AI agents which an AI agent can use or interact with; and (B) revoke or change at any time any of the allowances, denials, or restrictions described in clauses (i) through (iii) of subparagraph (A).Sec. 2(c)(7) over all AI agents operating within or interacting with the information systemsinformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6), networks, applications, services, or digital environments of such organizations; (B) maintain organizational controlorganizational controlThe term ‘‘organizational control’’ means the technical and organizational ability to— (A) allow, deny, or restrict— (i) an AI agent’s access to specific data; (ii) the actions an AI agent can perform; and (iii) the tools, information systems, and AI agents which an AI agent can use or interact with; and (B) revoke or change at any time any of the allowances, denials, or restrictions described in clauses (i) through (iii) of subparagraph (A).Sec. 2(c)(7) over AI agents deployed by such organization; (C) integrate discovery mechanisms into broader cybersecurity and risk management processes, consistent with defense-in-depthdefense-in-depthThe term ‘‘defense-in-depth’’ means the protection of information systems by using multiple security measures, including policies, procedures, and physical security, such as antivirus software, firewalls, anti-spyware tools, strong password policies, intrusion detection systems, biometric verification, encryption, and multifactor authentication, to reduce the risk of unauthorized access, data breach, or other successful attack.Sec. 2(c)(5); (D) apply discovery and verification controls consistently across AI agents regardless of whether such AI agents are developed internally, acquired from third-party vendors, or operated through external services; (E) evaluate the security, safety, correctness, and reliability of AI agents before such AI agents are deployed by such organization and continuously after such deployment; (F) enable continuous runtime monitoring and, where appropriate, inline detection and interception of AI agent interactions with tools, data sources, information systemsinformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6), and other AI agents, including detection of prompt injection, data exfiltration, anomalous tool invocation, and behavioral drift from an AI agent's approved operational baseline; (G) implement cryptographically verifiable provenance mechanisms sufficient to identify the entity responsible for creating or operating an AI agent; and (H) generate and retain tamper-evident, standardized logs of material AI agent actions, and ensure such logs are portable and accessible, as appropriate and consistent with law, to deploying organizations and authorized relying parties.

(a)(2) 1 AI AGENT DISCOVERYAI agent discoveryThe term ‘‘AI agent discovery’’ means the technical and organizational capability to identify, enumerate, verify, and maintain a current inventory of AI agents operating within, communicating with, or seeking access to an information system, network, application, service, or digital environment.Sec. 2(c)(1) AS A COMPONENT OF CYBERSECURITY.—In carrying out paragraph (1), the Director, in coordination with the Assistant Secretary, shall include in the standards, guidelines, and best practices described in such paragraph AI agent discoveryAI agent discoveryThe term ‘‘AI agent discovery’’ means the technical and organizational capability to identify, enumerate, verify, and maintain a current inventory of AI agents operating within, communicating with, or seeking access to an information system, network, application, service, or digital environment.Sec. 2(c)(1) as a necessary component of effective cybersecurity within applicable frameworks, profiles, and reference materials.

(a)(3) 1 OPEN AND INTEROPERABLE DISCOVERY STANDARDS.—The Director, in coordination with the Assistant Secretary, shall support the development and adoption of open, vendor-agnostic, and interoperable standards for AI agent discoveryAI agent discoveryThe term ‘‘AI agent discovery’’ means the technical and organizational capability to identify, enumerate, verify, and maintain a current inventory of AI agents operating within, communicating with, or seeking access to an information system, network, application, service, or digital environment.Sec. 2(c)(1) mechanisms. In carrying out this paragraph, the Director and the Assistant Secretary shall— (A) promote the use of existing internet infrastructure and identity-based discovery mechanisms, including domain name system-based approaches, cryptographically verifiable AI agent identity and registry frameworks, or functionally equivalent mechanisms, to enable secure and scalable AI agent discoveryAI agent discoveryThe term ‘‘AI agent discovery’’ means the technical and organizational capability to identify, enumerate, verify, and maintain a current inventory of AI agents operating within, communicating with, or seeking access to an information system, network, application, service, or digital environment.Sec. 2(c)(1) and AI agent identity verification; (B) ensure that such standards are globally interoperable, distributed, and not dependent on proprietary or platform-specific registries; and (C) engage with multistakeholder processes, including industry, civil society, and technical standards bodies, to support broad adoption and international coordination.

(a)(4) 2 MINIMUM ORGANIZATIONAL REQUIREMENTS.—Standards, guidelines, and best practices developed under this subsection shall provide that organizations deploying AI agents— (A) maintain a continuous, machine-readable inventory of all AI agents, using standardized, vendor-agnostic naming conventions; (B) implement AI agent identity verification and trust verification mechanisms that are independent and cryptographically verifiable at both the network and application layers; and (C) do not rely solely on self-attested or single-provider assertions for establishing AI agent identity.

(a)(5) 1 GUIDANCE, COORDINATION, AND DEMONSTRATION PROJECTS.—The Director, in coordination with the Assistant Secretary, shall— (A) incorporate the standards, guidelines, and best practices developed under this subsection into existing National Institute of Standards and Technology frameworks and guidance; (B) ensure that standards, guidelines, and best practices developed under this subsection are consistent with and not duplicative of other efforts by National Institute of Standards and Technology to establish standards related to AI agents; (C) conduct or support demonstration projects, including through the National Cybersecurity Center of Excellence, to evaluate the effectiveness of open agent discovery mechanisms; (D) coordinate with the Administrator of the National Telecommunications and Information Administration to promote outreach and adoption through multistakeholder processes and international engagement, as appropriate; and (E) coordinate with the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security to ensure AI agent discoveryAI agent discoveryThe term ‘‘AI agent discovery’’ means the technical and organizational capability to identify, enumerate, verify, and maintain a current inventory of AI agents operating within, communicating with, or seeking access to an information system, network, application, service, or digital environment.Sec. 2(c)(1) standards are reflected in applicable Federal civilian agency security guidance and binding operational directives, as appropriate.

(b)(1) 3 IN GENERAL.—Not later than 18 months after the publication of standards, guidelines, and best practices under subsection (a) and annually thereafter, the Federal Acquisition Regulatory Council shall propose revisions to the Federal Acquisition Regulation to require contractors and Federal agencies procuring or deploying, as the case may be, AI agents or information systemsinformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6) that interact with AI agents to comply with such standards, guidelines, and best practices.

(b)(2) 4 REQUIRED CONTRACT ELEMENTS.—Revisions proposed under paragraph (1) shall ensure contracts for the procurement or deployment of AI agents include requirements that the contractor— (A) maintain a continuous, machine-readable inventory of all AI agents deployed under such contract, using standardized, vendor-agnostic naming conventions consistent with standards, guidelines, and best practices developed under subsection (a); (B) implement AI agent identity verification mechanisms that are cryptographically verifiable at both the network and application layers; (C) ensure AI agent discoveryAI agent discoveryThe term ‘‘AI agent discovery’’ means the technical and organizational capability to identify, enumerate, verify, and maintain a current inventory of AI agents operating within, communicating with, or seeking access to an information system, network, application, service, or digital environment.Sec. 2(c)(1) and verification capabilities are accessible to the Federal agency that has entered into such a contract without reliance on the contractor with which such Federal agency has so entered into such a contract; (D) enable the Federal agency that has entered into such a contract to exercise organizational controlorganizational controlThe term ‘‘organizational control’’ means the technical and organizational ability to— (A) allow, deny, or restrict— (i) an AI agent’s access to specific data; (ii) the actions an AI agent can perform; and (iii) the tools, information systems, and AI agents which an AI agent can use or interact with; and (B) revoke or change at any time any of the allowances, denials, or restrictions described in clauses (i) through (iii) of subparagraph (A).Sec. 2(c)(7) over AI agent activity, including the ability to allow, deny, or constrain AI agent-to-AI agent and AI agent-to-information systeminformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6) interactions; (E) enable the Federal agency that has entered into such a contract to provide cryptographically verifiable provenance information to authorized entities interacting with the AI agent, consistent with the policies of such Federal agency; and (F) generate tamper-evident, standardized logs of material AI agent actions, and ensure such logs are portable and accessible to the Federal agency that has entered into such a contract and, where appropriate and consistent with law and such contract, authorized relying parties.

(b)(3) 5 REQUIRED CONTRACT ELEMENTS FOR INFORMATION SYSTEMSinformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6) INTERACTING WITH AI AGENTS.—Revisions proposed under paragraph (1) shall ensure contracts for the procurement or deployment of information systemsinformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6) that AI agents interact with include requirements that the contractor— (A) maintain a continuous, machine-readable inventory of all AI agents that interact with such an information systeminformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6), using standardized, vendor-agnostic naming conventions consistent with standards, guidelines, and best practices developed under subsection (a); (B) implement identity verification mechanisms that are cryptographically verifiable for all AI agents that interact with such an information systeminformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6); (C) implement provenance verification mechanisms that are cryptographically verifiable for all AI agents that interact with such an information systeminformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6); (D) ensure AI agent discoveryAI agent discoveryThe term ‘‘AI agent discovery’’ means the technical and organizational capability to identify, enumerate, verify, and maintain a current inventory of AI agents operating within, communicating with, or seeking access to an information system, network, application, service, or digital environment.Sec. 2(c)(1) and verification capabilities are accessible to the Federal agency that has entered into such a contract without reliance on the contractor with which such Federal agency has so entered into such a contract; (E) enable the Federal agency that has entered into such a contract to exercise organizational controlorganizational controlThe term ‘‘organizational control’’ means the technical and organizational ability to— (A) allow, deny, or restrict— (i) an AI agent’s access to specific data; (ii) the actions an AI agent can perform; and (iii) the tools, information systems, and AI agents which an AI agent can use or interact with; and (B) revoke or change at any time any of the allowances, denials, or restrictions described in clauses (i) through (iii) of subparagraph (A).Sec. 2(c)(7) over AI agents' ability to interact with such an information systeminformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6), including the ability to allow, deny, or constrain AI agent-to-AI agent interactions within such an information systeminformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6); and (F) generate tamper-evident, standardized logs of material AI agent actions within such an information systeminformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6) and ensure such logs are portable and accessible to the Federal agency that has entered into such a contract and, where appropriate and consistent with law and such contract, authorized relying parties.

(b)(4) SAVING PROVISION FOR CERTAIN CONTRACTS.—This subsection shall not apply to contracts for the procurement or deployment, as the case may be, of AI agents or information systemsinformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6) that interact with AI agents entered into before the date of the enactment of this Act.

(b)(5) 6 AGENCY GUIDANCE.—Not later than 180 days after the proposal of revisions under paragraph (1) and annually thereafter, the Director of the Office of Management and Budget, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall issue guidance to Federal agencies regarding the following: (A) The implementation of procurement requirements under this subsection, including for AI agents deployed through cloud services, platform integrations, or third-party managed environments. (B) The effective usage of AI agents by such Federal agencies in accordance with the standards, guidelines, and best practices under subsection (a).

(c)(1) AI AGENT DISCOVERYAI agent discoveryThe term ‘‘AI agent discovery’’ means the technical and organizational capability to identify, enumerate, verify, and maintain a current inventory of AI agents operating within, communicating with, or seeking access to an information system, network, application, service, or digital environment.Sec. 2(c)(1).—The term ‘‘AI agent discoveryAI agent discoveryThe term ‘‘AI agent discovery’’ means the technical and organizational capability to identify, enumerate, verify, and maintain a current inventory of AI agents operating within, communicating with, or seeking access to an information system, network, application, service, or digital environment.Sec. 2(c)(1)’’ means the technical and organizational capability to identify, enumerate, verify, and maintain a current inventory of AI agents operating within, communicating with, or seeking access to an information systeminformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6), network, application, service, or digital environment.

(c)(2) AI; ARTIFICIAL INTELLIGENCEAI; artificial intelligenceThe terms ‘‘AI’’ and ‘‘artificial intelligence’’ have the meaning given the term ‘‘artificial intelligence’’ in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Sec. 2(c)(2).—The terms ‘‘AI’’ and ‘‘artificial intelligence’’ have the meaning given the term ‘‘artificial intelligence’’ in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).

(c)(3) AI MODELAI modelThe term ‘‘AI model’’ means a software component of an information system that implements artificial intelligence technology and uses computational, statistical, or machine-learning techniques to produce outputs from a defined set of inputs.Sec. 2(c)(3).—The term ‘‘AI modelAI modelThe term ‘‘AI model’’ means a software component of an information system that implements artificial intelligence technology and uses computational, statistical, or machine-learning techniques to produce outputs from a defined set of inputs.Sec. 2(c)(3)’’ means a software component of an information systeminformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6) that implements artificial intelligence technology and uses computational, statistical, or machine-learning techniques to produce outputs from a defined set of inputs.

(c)(4) ARTIFICIAL INTELLIGENCE AGENT; AI AGENTartificial intelligence agent; AI agentThe terms ‘‘artificial intelligence agent’’ and ‘‘AI agent’’ mean a software-based system that— (A) uses an AI model to perceive, plan, or make decisions; (B) autonomously interacts with other software systems, digital services, users, external environments, or AI agents on behalf of a person or organization; and (C) involves minimal or no human interaction beyond its initial direction.Sec. 2(c)(4).—The terms ''artificial intelligence agent'' and ''AI agent'' mean a software-based system that— (A) uses an AI modelAI modelThe term ‘‘AI model’’ means a software component of an information system that implements artificial intelligence technology and uses computational, statistical, or machine-learning techniques to produce outputs from a defined set of inputs.Sec. 2(c)(3) to perceive, plan, or make decisions; (B) autonomously interacts with other software systems, digital services, users, external environments, or AI agents on behalf of a person or organization; and (C) involves minimal or no human interaction beyond its initial direction.

(c)(5) DEFENSE-IN-DEPTHdefense-in-depthThe term ‘‘defense-in-depth’’ means the protection of information systems by using multiple security measures, including policies, procedures, and physical security, such as antivirus software, firewalls, anti-spyware tools, strong password policies, intrusion detection systems, biometric verification, encryption, and multifactor authentication, to reduce the risk of unauthorized access, data breach, or other successful attack.Sec. 2(c)(5).—The term ‘‘defense-in-depthdefense-in-depthThe term ‘‘defense-in-depth’’ means the protection of information systems by using multiple security measures, including policies, procedures, and physical security, such as antivirus software, firewalls, anti-spyware tools, strong password policies, intrusion detection systems, biometric verification, encryption, and multifactor authentication, to reduce the risk of unauthorized access, data breach, or other successful attack.Sec. 2(c)(5)’’ means the protection of information systemsinformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6) by using multiple security measures, including policies, procedures, and physical security, such as antivirus software, firewalls, anti-spyware tools, strong password policies, intrusion detection systems, biometric verification, encryption, and multifactor authentication, to reduce the risk of unauthorized access, data breach, or other successful attack.

(c)(6) INFORMATION SYSTEMinformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6).—The term ‘‘information systeminformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6)’’ has the meaning given such term in section 3502 of title 44, United States Code.

(c)(7) ORGANIZATIONAL CONTROLorganizational controlThe term ‘‘organizational control’’ means the technical and organizational ability to— (A) allow, deny, or restrict— (i) an AI agent’s access to specific data; (ii) the actions an AI agent can perform; and (iii) the tools, information systems, and AI agents which an AI agent can use or interact with; and (B) revoke or change at any time any of the allowances, denials, or restrictions described in clauses (i) through (iii) of subparagraph (A).Sec. 2(c)(7).—The term ''organizational controlorganizational controlThe term ‘‘organizational control’’ means the technical and organizational ability to— (A) allow, deny, or restrict— (i) an AI agent’s access to specific data; (ii) the actions an AI agent can perform; and (iii) the tools, information systems, and AI agents which an AI agent can use or interact with; and (B) revoke or change at any time any of the allowances, denials, or restrictions described in clauses (i) through (iii) of subparagraph (A).Sec. 2(c)(7)'' means the technical and organizational ability to— (A) allow, deny, or restrict— (i) an AI agent's access to specific data; (ii) the actions an AI agent can perform; and (iii) the tools, information systemsinformation systemThe term ‘‘information system’’ has the meaning given such term in section 3502 of title 44, United States Code.Sec. 2(c)(6), and AI agents which an AI agent can use or interact with; and (B) revoke or change at any time any of the allowances, denials, or restrictions described in clauses (i) through (iii) of subparagraph (A).