The Stop Rogue AI Act is a bipartisan bill that would set the first federal security standards for AI agents in the United States. Reps. Josh Gottheimer (D-NJ) and Mike Lawler (R-NY) introduced it in the House in September 2026, and the sponsor’s press release is dated September 9.
A lot of coverage has made the Stop Rogue AI Act sound like a law that already applies to every business using a chatbot. It does not. It is a bill at the introduction stage, and its mandatory parts are aimed at federal agencies and government contractors.
This guide explains what the bill would actually require, who it would cover, and what small businesses that use AI agents should do now.
Table of Contents
What Is the Stop Rogue AI Act?
The Stop Rogue AI Act is designed to give organizations visibility and control over the AI agents running on their networks: software that can take actions on its own, such as sending messages, calling APIs, changing files or moving money.
Its sponsors frame it as a way to keep people in control of autonomous AI. Rather than banning anything, the bill asks the National Institute of Standards and Technology (NIST) to write security standards for discovering, verifying, monitoring and controlling AI agents.
What the Stop Rogue AI Act Would Require
Based on the sponsor’s announcement and reporting on the bill, the Stop Rogue AI Act would direct the Department of Commerce and NIST to publish guidelines for the secure deployment of AI agents within one year of the bill becoming law.
Reported elements of those standards include:
- A real-time, machine-readable inventory of active AI agents on an organization’s network
- Continuous verification of the actions agents take
- Tamper-resistant logs of agent activity
- Records that tie each agent to its developer or vendor
The exact wording, thresholds and definitions will only be clear once the full bill text is published and reviewed in committee.
Who the Stop Rogue AI Act Actually Covers
This is the part most coverage gets wrong. The mandatory requirements in the Stop Rogue AI Act target the federal government, not private businesses in general.
| Group | How the bill would apply |
|---|---|
| Federal civilian agencies | Required to adopt the NIST safeguards |
| Federal contractors bidding on new work | Required to meet the standards through procurement rules |
| Other private businesses | Voluntary guidance only |
| Timeline | NIST standards due within one year of enactment, if the bill passes |
If your small business does not sell to the federal government, the bill would not create direct legal obligations for you. If you are a federal contractor, or plan to bid on federal work, it is worth tracking closely.
What the Bill Does Not Do
Several articles about the Stop Rogue AI Act describe rules that do not appear in the sponsor’s announcement or in independent reporting. Based on what has been published, the bill does not:
- Apply as law today. It has been introduced in the House, with no reported committee action or passage.
- Set fines of hundreds of thousands of dollars per incident for small businesses.
- Impose a 2026 compliance deadline on private companies.
- Require every chatbot to follow a specific disclosure script.
If you read claims like these elsewhere, check them against the bill text on Congress.gov before acting on them.
Why Lawmakers Introduced It
Gottheimer’s office pointed to recent incidents involving autonomous AI agents, including an OpenAI and Hugging Face security incident, and to the growing risk of autonomous cyberattacks. The argument is simple: organizations are deploying AI agents faster than they can track what those agents are doing.
The bill fits a wider trend. Regulators are paying closer attention to AI agents, as our coverage of the FTC investigation into AI agents shows, and vendors are building tooling for agent oversight, such as the NVIDIA Open Agent Safety Platform.
What Small Businesses Should Do Now
Even if the Stop Rogue AI Act never becomes law, the practices it describes are sensible for any business running AI agents. They are also likely to show up in vendor contracts, insurance questionnaires and enterprise customer requirements.
Four practical steps:
- Keep an inventory. List every AI agent and automation that can act on its own: what it does, what it can access, and who supplies it.
- Log agent actions. Turn on activity logs in your automation tools and keep them somewhere agents cannot edit.
- Keep a human in the loop for high-stakes actions, such as payments, refunds, contract changes or messages sent on your behalf.
- Ask vendors the right questions: what logs they provide, how agents are identified, and how you can pause or revoke an agent quickly.
If you are building or scaling agents, our guide to AI agents for small business covers how to roll them out safely.
The Bottom Line
The Stop Rogue AI Act is a real and bipartisan proposal, but it is an early-stage bill, not a law. Its mandatory requirements would fall on federal agencies and contractors, with voluntary guidance for everyone else.
For small businesses, the smart move is not to panic about compliance deadlines that do not exist. It is to adopt the basics the bill describes (an agent inventory, logs and human oversight), because they reduce real risk today, whatever happens in Congress.