Artificial Intelligence Risk Management and Security Act of 2026

(a) Agentic artificial intelligence profile

(1) In general. Not later than 18 months after the date of the enactment of this Act, the Director of the Institute shall develop, in collaboration with other public and private sector organizations as appropriate, a cross-sectoral profile (referred to in this section as the Agentic AI Profile) of the Artificial Intelligence Risk Management Framework (NIST AI 100–1) or any successor framework (referred to in this section as the Framework) for artificial intelligence agents.

(2) Purpose and contents. The Agentic AI Profile shall assist organizations in using the Framework to map, measure, manage, and govern risks associated with artificial intelligence agents. The Agentic AI Profile shall, at a minimum—

(A) define risks that are novel to or exacerbated by artificial intelligence agents;

(B) include a framework for classification of agent autonomy levels; and

(C) address cybersecurity risks specific to artificial intelligence agents, including risks related to agent identity, authentication, and authorization, and the relationship of such risks to the Cybersecurity Framework (NIST CSWP–29) or any successor framework.

(3) Relationship to the Framework. The Agentic AI Profile shall be a companion resource to the Framework and shall not modify or supersede the Framework.

(b) Common template for artificial intelligence agent assurance

(1) In general. Not later than 18 months after the date of the enactment of this Act, the Director of the Institute shall initiate, in collaboration with other public and private sector organizations and Federal agencies as appropriate, the development of a common template to document artificial intelligence agents and their evaluation against widely recognized standards and frameworks.

(2) Elements. The template shall enable the consistent documentation of artificial intelligence agents by providing standardized terminology and fields that relate to, at a minimum, the following elements:

(A) Identity and version.

(B) Intended use and evaluated scope.

(C) Ownership and authority boundaries.

(D) Access to data, systems, and tools.

(E) Evaluations against widely recognized standards and frameworks.

(F) The identity of any independent evaluator, where applicable.

(G) Known limitations and conditions of use.

(3) Applicability. The Director shall design the template to be used across sectors, industries, and organizational contexts by entities of differing sizes and resources.

(c) Coordination. The Director shall ensure that the template developed under this subsection is consistent with and not duplicative of other efforts by the Institute related to artificial intelligence agents.