US Federal AI Bills Tracker: Status, Obligations and Security Impact of Every Major Bill

Congress has never had more AI bills in front of it, and none of the frontier AI, agent or shutdown bills introduced in 2026 has become law. Between June and October 2026 members of both parties introduced or circulated proposals for frontier model oversight, mandatory shutdown capability, AI agent identity standards, criminal liability for rogue agents, incident reporting and even an outright ban on superintelligence. Two Senate attempts to pass bills by unanimous consent were blocked in September. This tracker records each major bill's number, sponsors, status and core obligations as at 11 November 2026, groups them by theme, and explains what they would mean for security, AI platform and identity teams if they move. It is the hub for NHI Mgmt Group's individual bill guides; for the executive orders and OMB memos that do apply today, see the US Federal AI Policy Guide.

Last reviewed: November 2026. Status is taken from bill texts on govinfo.gov, sponsor offices and named news reports. Bills change in committee and lapse at the end of the 119th Congress on 3 January 2027 unless enacted. Nothing on this page is law unless stated. Confirm against the official text before relying on it. Compliance steps, decision guidance and checklists on this page are NHI Mgmt Group recommendations, not requirements of the text.

Key takeaways

• No 2026 frontier or agent bill is law. Every bill below is introduced, announced or in discussion draft; federal AI obligations still come from executive orders, OMB memos and existing statutes.
• Two camps are visible. Bipartisan House bills (FRONTIER Act, Stop Rogue AI Act, AI Incident Reporting Act) favour standards, transparency and preemption; Senate proposals range from mandatory 45-day pre-release access to a superintelligence ban.
• Unanimous consent has failed twice. Senator Rand Paul objected to the AI Emergency Button Act on 16 September 2026 and Senator Ted Cruz to the AI Risk Management and Security Act on 29 September 2026.
• Agent identity is now in bill text. H.R. 10362 would have NIST define agent inventories, cryptographically verifiable agent identity and tamper-evident logs, then push them into federal contracts.
• Prepare for the common core, not one bill. Shutdown capability, incident reporting within days, agent inventory and audit logs recur across bills from both parties; building them now is useful whichever bill moves.

How to read bill status

Master tracker

Frontier model oversight bills

• FRONTIER Act: the most detailed bipartisan text. According to the sponsors' section-by-section, a frontier model is one trained with more than 10²⁶ operations; "large" developers have more than $50 million revenue and at least $1 billion in AI spending, "very large" developers more than $5 billion and at least $10 billion. All frontier developers publish transparency reports; large developers publish a frontier AI framework and take an annual independent audit; very large developers retain a licensed Independent Verification Organization that must refer imminent catastrophic risk to the Secretary within 72 hours. A new Under Secretary of Commerce for AI Security runs it. Section 9 would stop states imposing new obligations in these areas. Civil penalties reach $1 million per violation per day. See the FRONTIER Act Guide.
• Great American AI Act: the umbrella discussion draft from the same House group, released 4 June 2026 for comment. The FRONTIER Act was introduced as part of that framework. See the Great American AI Act Guide.
• AI Risk Management and Security Act of 2026: the Senate Democratic alternative. News reports describe an AI Safety Board in Commerce, model access at least 45 days before release, safety plans, and incident reporting within 30 days or 72 hours for imminent national security threats. Senator Cruz objected to passage by unanimous consent on 29 September 2026, the same day the President and several AI companies signed a voluntary accord. See the AI Risk Management and Security Act Guide and the White House Frontier AI Safety Accord Guide.

Shutdown and emergency control bills

See the AI Kill Switch Act Guide, the AI Emergency Button Act Guide and the AI Shutdown and Kill Switch Laws Map. Whatever the bill, the engineering requirement is the same: a tested, logged way to throttle or stop a model or agent fleet. The AI Agent Kill Switch and Containment Guide covers how to build it.

AI agent security, identity and liability bills

• Stop Rogue AI Act (H.R. 10362): NIST, with NTIA, would publish standards within one year covering a continuous machine-readable inventory of agents, identity and trust verification that is cryptographically verifiable and not only self-attested, pre-deployment and continuous evaluation, runtime monitoring for prompt injection, exfiltration and drift, provenance, tamper-evident logs of material agent actions, and open discovery mechanisms. The FAR Council would propose contract rules within 18 months of the standards. The text has no penalties. See the Stop Rogue AI Act Guide.
• AI AGENT Act (S. 5051): a competition and consumer bill rather than a security bill, but with identity content. Registered custodial user agents would get authenticated, user-revocable access to large platforms, owe fiduciary-like duties, keep real-time action records, and face FTC enforcement as unfair or deceptive practices. See the AI Agent Act Guide.
• AI Agent Accountability Act: announced by Senators Hawley and Murphy on 1 October 2026. Operators would be liable under the Computer Fraud and Abuse Act for knowingly operating an agent that recklessly causes hacking damage, and developers for failing to put reasonable safeguards in place when they knew of hacking capabilities. The Attorney General and state attorneys general could seek injunctions. See the AI Agent Liability Bills Guide and the US Computer Fraud and Abuse Act Guide.

Where identity fits

Three of these bills turn on whether you can say which agent did what, under whose authority. Inventory, unique non-human identity per agent, scoped credentials and tamper-evident logs are the controls that would satisfy H.R. 10362, support the record-keeping in S. 5051, and show that an operator did not "knowingly" run a harmful agent under the Hawley and Murphy proposal. The OpenAI agents and US government websites case, where agents used Census API keys found in public repositories, is the kind of incident these bills respond to. See the Agent Identity and Access Guide.

Incident reporting and prohibition bills

• AI Incident Reporting Act (H.R. 9477): Commerce would set thresholds for covered models by rule within 180 days. Developers of covered models, including those that substantially modify weights, would report within 7 days activity such as a model evading oversight or resisting shutdown, theft or attempted theft of weights, offensive cyber capability, uplift toward chemical, biological, radiological, nuclear or explosive weapons, and near misses. Civil penalties reach $2,000,000 per violation, with each day a separate violation. See the AI Incident Reporting Act Guide and the AI Incident Reporting Guide.
• Ban Artificial Superintelligence Act: the sponsors' summary defines artificial superintelligence as a system that matches or exceeds human cognitive performance across a broad range of tasks, or could plan the disempowerment of humanity. It would ban development and deployment, pause advanced AI work until a new cabinet-level agency sets rules, and impose up to 20 years in prison for individuals. See the Ban Artificial Superintelligence Act Guide.

Common obligations across bills

Related executive actions

• EO 14409 (2 June 2026): voluntary pre-release access for covered frontier models and an AI cybersecurity clearinghouse. See the Promoting Advanced AI Innovation and Security Executive Order Guide.
• EO 14434, Inaugurating the Era of Super Intelligence (29 September 2026): directs agencies to use "Super Intelligence" and "SI" in place of "Artificial Intelligence" and "AI" in non-statutory documents, keeps the statutory definition in 15 U.S.C. 9401(3) for now, and asks the Assistant to the President for Science and Technology for proposed legislative definition language within 60 days. It changes vocabulary, not obligations; watch for that proposal reaching Congress.
• Preemption: the administration's March 2026 legislative recommendations asked Congress to preempt burdensome state AI laws; the FRONTIER Act's Section 9 is the clearest bill text that would do so for frontier developers.

Decision guidance

• Frontier developers: map current safety frameworks and incident processes against the FRONTIER Act tiers and the H.R. 9477 7-day clock; these are the bills with full published text and bipartisan sponsors.
• Enterprises deploying agents: the Stop Rogue AI Act and liability proposals matter more than frontier bills. Inventory and identity work pays off now, under existing contracts and CFAA exposure, whether or not they pass.
• Federal contractors: watch H.R. 10362; its FAR route would turn NIST guidance into contract clauses.
• Small organisations: FRONTIER thresholds exclude you; focus on state laws and sector rules. See the Global AI Regulation Map.

Tracking and measurement

1. Assign an owner for federal AI legislation and record each bill here with the date you last checked it.
2. Subscribe to govinfo.gov bill text updates and sponsor press pages; check monthly, weekly during markup.
3. For each bill, record the obligation, the affected system and the gap; re-score when text changes.
4. Pilot the common core (inventory, shutdown test, incident clock) on one agent platform, then extend.
5. Roll back nothing on the strength of a bill: a bill that stalls does not remove contractual or state obligations.

• Metric: percentage of production agents with a named owner, unique identity and logged actions.
• Metric: time from AI incident detection to internal classification, against a 72-hour target.
• Metric: date and result of the last shutdown or throttle test per critical model or agent fleet.
• Metric: days since the tracker was last reviewed (target under 31).

Common failure patterns

• Treating a bill as law: internal policies citing "the AI Kill Switch Act requires" when it is only introduced.
• Treating a blocked UC request as dead: an objection stops fast-track passage, not the bill.
• Relying on preemption that has not happened: state laws such as California SB 53 and the New York RAISE Act stay in force unless Congress passes preemptive text. See the New York RAISE Act Guide.
• Tracking frontier bills only: missing agent liability and identity bills that affect every deployer.
• Quoting numbers from aggregators: bill numbers and dates should come from govinfo.gov or the sponsor's text.

Framework mapping

Practitioner checklist

• Name an owner for federal AI legislation and review this tracker monthly.
• Label internal references to bills as proposals, never as requirements.
• Inventory every AI agent with an owner, unique identity and scoped credential.
• Enable tamper-evident logging of material agent actions.
• Test a throttle and shutdown path for each critical model or agent fleet.
• Define AI incident categories and a reporting clock of 72 hours or less internally.
• Developers: map frameworks and audits to FRONTIER Act tiers.
• Contractors: watch H.R. 10362 for FAR changes.

Standards and references

• GovInfo: H.R. 10362 Stop Rogue AI Act (introduced)
• GovInfo: H.R. 9477 AI Incident Reporting Act (introduced)
• Office of Rep. Trahan: FRONTIER Act Section-by-Section
• Office of Sen. Warner: AI AGENT Act Section-by-Section
• Office of Sen. Hawley: AI Agent Accountability Act announcement
• Office of Rep. Lieu: AI Kill Switch Act introduction
• Office of Sen. Sanders: Ban Artificial Superintelligence Act Summary
• Implicator: Cruz blocks AI bill requiring 45-day model access

Related NHI Mgmt Group resources: US Federal AI Policy Guide · Global AI Regulation Map · AI Kill Switch Act Guide · Agent Identity Standards Tracker. This guide summarises proposed US federal AI legislation and is not legal advice.