Full Text
Official text as published. Use Ctrl+F / Cmd+F to search within the document.
[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[H.R. 10873 Introduced in House (IH)]
<DOC>
119th CONGRESS
2d Session
H. R. 10873
To require the National Institute of Standards and Technology to carry
out certain activities regarding certain artificial intelligence
attacks, and for other purposes.
_______________________________________________________________________
IN THE HOUSE OF REPRESENTATIVES
October 22, 2026
Mr. Harrigan (for himself and Mr. Whitesides) introduced the following
bill; which was referred to the Committee on Science, Space, and
Technology
_______________________________________________________________________
A BILL
To require the National Institute of Standards and Technology to carry
out certain activities regarding certain artificial intelligence
attacks, and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``AI Cyber Defense Act''.
SEC. 2. NIST AI DISTILLATION AND CYBERSECURITY STANDARDS.
(a) In General.--
(1) Engagement.--Not later than 180 days after the date of
the enactment of this Act, the Director of the National
Institute of Standards and Technology (NIST) shall seek to
engage with private sector artificial intelligence stakeholders
to establish the following:
(A) A definition for artificial intelligence
distillation attacks.
(B) Voluntary standards and best practices for the
detection and prevention of such attacks.
(2) Publication.--Not later than one year after the
establishment of voluntary standards and best practices under
paragraph (1), the Director shall publish on the website of
NIST such voluntary standards and best practices.
(b) Standards and Best Practices.--Not later than 180 days after
the date of the enactment of this Act, the Director of NIST shall
establish a roundtable, to be known as the ``AI Cybersecurity
Roundtable'' (in this subsection referred to as the ``Roundtable''), to
develop voluntary standards and best practices relating to the
defensive use of artificial intelligence for cybersecurity purposes.
The Director shall seek representation on the Roundtable of private
sector artificial intelligence stakeholders and owners and operators of
critical infrastructure. Not later than one year after the
establishment of the Roundtable, the Director shall publish on the
website of NIST such voluntary standards and best practices.
(c) Definitions.--In this section:
(1) Artificial intelligence.--The term ``artificial
intelligence'' has the meaning given such term in section 5002
of the Artificial Intelligence Initiative Act of 2020 (15
U.S.C. 9401).
(2) Country of concern.--The term ``country of concern''
means--
(A) The People's Republic of China, including the
Hong Kong and Macau Special Administrative Regions.
(B) The Russian Federation.
(C) The Islamic Republic of Iran.
(D) The Democratic People's Republic of Korea.
(E) The Republic of Cuba.
(3) Critical infrastructure.--The term ``critical
infrastructure'' has the meaning given such term in section
1016(e) of Public Law 107-56 (42 U.S.C. 5195c(e)).
(4) Entity of concern.--
(A) In general.--The term ``entity of concern''
means any foreign person or entity that--
(i) is headquartered in, or the parent
company of which is headquartered in, a country
of concern;
(ii) is operating under the direction or
control of any entity headquartered in, or the
parent company of which is headquartered in, a
country of concern; or
(iii) the Director of NIST determines to be
an entity of concern for purposes of this
section.
(B) Exception.--The term ``entity of concern'' does
not include a person who--
(i) lawfully admitted for permanent
residence (as such term is defined in section
101(a) of the Immigration and Nationality Act
(8 U.S.C. 1101(a))); or
(ii) a citizen of the United States.
(5) Private sector artificial intelligence stakeholders.--
The term ``private sector artificial intelligence
stakeholders'' means any corporation, partnership, limited
liability company, sole proprietorship, or other business
entity that--
(A) is not a unit, agency, instrumentality, or
wholly owned enterprise of a Federal, State, local, or
Tribal government;
(B) develops, trains, deploys, offers, sells, or
licenses one or more artificial intelligence systems,
or provides substantial computing infrastructure, data,
or technical services for the development or deployment
of such systems, as part of its ordinary business
activities does so for commercial purposes, including
for profit, in exchange for consideration, or in
furtherance of a business enterprise, regardless of
whether such entity has yet generated revenue; and
(C) is not an entity of concern.
<all>