Federal Artificial Intelligence Risk Management Act of 2026

This bill requires federal agencies to use the Artificial Intelligence Risk Management Framework developed by the National Institute of Standards and Technology (NIST) for their use of AI systems. It amends existing law to direct NIST to develop standards, guidelines, and minimum requirements for AI systems used by federal agencies or their contractors, excluding national security systems, and to manage risks related to AI trustworthiness, as well as to authenticate and label synthetic content generated by agencies.

Sec. 2, Standards for artificial intelligence systems: The Director of NIST, in consultation with the Office of Management and Budget and other agencies, must develop federal standards and guidelines for AI systems used by agencies or their contractors, excluding national security systems. These include minimum requirements for managing risks to AI trustworthiness, and for authenticating, tracking provenance of, and labeling synthetic content generated by agencies or their contractors. The Director must also conduct research to inform these standards.

In developing these standards, the Director must provide tools consistent with the NIST AI Risk Management Framework, ensure consistency with that framework and OMB Circular A-119, recommend training for procurement, identify performance measures, provide guidelines for agency-specific AI profiles, evaluate national security AI policies for broader risk management application, and periodically assess and revise the standards.

When standards are ready for widespread adoption, the Director must submit them to the Secretary of Commerce for promulgation, provide technical assistance to agencies, and evaluate the effectiveness of implementation.

The Director must also conduct a gap analysis of existing technical standards for testing and evaluating AI acquisitions, then convene stakeholders to develop standards for testing, evaluation, verification, and validation related to AI acquisitions, and submit those standards for promulgation when ready. A report on the gap analysis and plan must be submitted to Congress within 90 days.

The bill defines key terms: 'agency' as executive branch departments and establishments; 'artificial intelligence system' as any system meeting the definition of AI in existing law or any data system, software, hardware, application, tool, or utility operating in part using such a system; 'Director' as the NIST Director; 'framework' as the NIST AI 100-1 document; 'profile' as an implementation of the framework for a specific setting; and 'synthetic content' as information significantly modified or generated by algorithms, including AI.