Federal Artificial Intelligence Risk Management Act of 2026
- Sponsor
- Rep. Lieu, Ted [D-CA-36]
- Committees
- Science, Space, and Technology Committee (primary)
- Last action
- May 14, 2026
Bottom line
The bill establishes a standardized, government-wide approach to managing AI risks by requiring federal agencies to adopt NIST's AI Risk Management Framework, aiming to ensure responsible and trustworthy AI use.
What it actually does
This bill mandates that federal agencies, excluding those dealing with national security systems, must use the Artificial Intelligence Risk Management Framework developed by the National Institute of Standards and Technology (NIST). It directs NIST to develop and promulgate federal standards and guidelines for AI systems, including minimum requirements for trustworthiness, synthetic content provenance, and testing/evaluation for AI acquisitions.
Proponents argue
Proponents argue that this bill provides a crucial, standardized approach to managing the risks associated with artificial intelligence in federal government operations. By leveraging NIST's expertise and existing framework, it ensures responsible development, procurement, and use of AI systems, fostering public trust and mitigating potential harms like bias and lack of transparency across the federal landscape.
Opponents contend
Opponents might contend that mandating a specific framework could create undue bureaucratic burdens for federal agencies and potentially stifle innovation, especially given the rapid evolution of AI technology. Concerns could also be raised about the scope of exclusions for national security systems, which represent a significant portion of government AI use, potentially creating a less rigorous oversight environment in critical areas.
The bill is concise and relatively straightforward, allowing for a quick and comprehensive understanding of its core directives within a short reading time.
Section 2(a), adding new Section 5304(a)(1) and (b)(1) to Public Law 116-283
Mandate for Federal Agencies to Use NIST AI Risk Management Framework
This provision requires the Director of the National Institute of Standards and Technology (NIST) to develop federal standards and guidelines, including minimum requirements, for artificial intelligence systems used or operated by federal agencies or their contractors. These standards must be consistent with the NIST AI Risk Management Framework (NIST AI 100-1), effectively mandating its use for non-national security systems across the federal government.
Supporters argue
Supporters argue that mandating a consistent, expert-developed framework like NIST's AI RMF is crucial for ensuring responsible AI deployment across government, mitigating risks such as bias, privacy violations, and lack of transparency. It provides a necessary baseline for ethical and effective AI use.
Critics contend
Critics might argue that mandating a specific framework could lead to bureaucratic hurdles, potentially slowing down the adoption of beneficial AI technologies or proving too rigid for the rapidly evolving nature of AI. They may also express concerns about the costs associated with widespread implementation.
Tradeoffs
The provision navigates the tension between the need for standardized risk management and the desire for flexibility and rapid innovation in AI development. It aims to achieve a balance where risks are systematically addressed without unduly stifling technological progress.
Section 2(a), adding new Section 5304(a)(2) and (a)(3) to Public Law 116-283
Development of Standards for AI Trustworthiness and Synthetic Content Provenance
This section directs NIST to develop specific standards and guidelines for two critical areas: managing risks associated with the trustworthiness of AI systems across all agency operations (again, excluding national security systems), and for authenticating, tracking the origin (provenance) of, and labeling synthetic content generated by or on behalf of federal agencies. This aims to ensure the reliability of government AI and combat misinformation.
Section 2(a), adding new Section 5304(d) to Public Law 116-283
Development of Testing and Evaluation Standards for AI Acquisitions
This provision directs NIST to first conduct a gap analysis of existing and forthcoming voluntary technical standards for the testing, evaluation, verification, and validation (TEVV) of AI systems or services acquired by federal agencies. Following this study, NIST is required to convene stakeholders, develop, and periodically update TEVV standards and guidelines for AI acquisitions, which will then be submitted to the Secretary of Commerce for promulgation when ready for widespread federal adoption.
The bill explicitly excludes 'national security systems (as defined in section 3552(b)(6) of title 44, United States Code)' from the requirements for developing federal standards and guidelines for AI systems, trustworthiness, and synthetic content.
Section 2(a), adding new Section 5304(a)(1), (a)(2), and (a)(3)
Why it matters:This is standard legislative practice to reference existing definitions and to carve out national security for separate treatment due to unique operational requirements and classification concerns, which often fall under different regulatory frameworks.
Case for: National security systems operate under distinct mandates and often involve classified information, making general civilian AI risk management frameworks potentially impractical or even detrimental to security. This carve-out allows for specialized, appropriate oversight.
Case against: Excluding national security systems from these general AI risk management standards could create a significant gap in oversight, potentially leading to less rigorous accountability for AI in critical defense and intelligence applications. This could have severe consequences if AI systems fail, are biased, or are compromised.
Estimated impact: Significant, as it delineates a major category of federal AI use that will not be subject to these specific NIST standards, potentially affecting a vast array of defense and intelligence AI applications.
The definition of 'artificial intelligence system' for the purposes of this bill relies on the definition of 'artificial intelligence' found in section 5002 of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021 (15 U.S.C. 9401).
Section 2(a), adding new Section 5304(e)(2)(A)
Why it matters:This is standard legislative practice to ensure consistency and avoid redundancy across federal law by referencing existing, established definitions, rather than creating a new one for every piece of legislation.
Case for: Referencing an existing definition promotes consistency across federal AI policy, ensuring that the scope of 'artificial intelligence' is uniformly understood and applied across different legislative acts, thereby avoiding potential conflicts or ambiguities.
Case against: For a casual reader, the reliance on an external definition means that the full scope of the bill's applicability is not immediately apparent, requiring an additional step to fully understand the foundational terms.
Estimated impact: Ensures a broad and consistent definition of AI is applied to this bill, encompassing various AI technologies as previously defined in federal law.