The Stop Rogue AI Act (H.R. 10362), introduced in the U.S. House of Representatives in September 2026, would direct the U.S. National Institute of Standards and Technology (NIST) to write security standards for AI agents within a year of enactment. The bill defines an AI agent as software that uses an AI model to make decisions and take actions on its own, with little or no human involvement.
The bill would require two things someone has to write (probably tech writers). The first is a set of permissions saying what data each agent may access, what actions it may take, and which tools and systems it may use. The second is an “approved operational baseline” (whatever that means) that monitoring software would check the agent’s behavior against.
Of course, the bill doesn’t define a baseline, so each agency or contractor using an AI agent would decide on their own what goes in one. It would likely describe the agent’s job, including the tasks it performs and the actions it mustn’t take. That’s close to the work tech writers do when they document user roles, permissions, and product behavior.
In a hypothetical case, the documentation for an autonomous AI agent that handles customer support describes it as able to “manage customer accounts,” while its approved role allows it to update contact details and while prohibiting it from changing billing information.
The documentation would need to explicitly state the restriction and identify the policy behind it. If the bill becomes law, federal agencies and their contractors would need that documentation, and tech writing teams are likely candidates to produce it.
The Federal Acquisition Regulatory Council, which oversees the rules U.S. federal agencies follow when buying goods and services, would have 18 months after NIST publishes its standards to propose changes to those rules. Any new contract requirements would take time to arrive.
If your company sells AI agents, or software those agents interact with, to U.S. federal agencies, its new federal contracts would carry these potential new requirements. Companies without federal contracts wouldn’t be required to do anything, though they could follow NIST’s standards voluntarily. 🤠
