H.R. 10873 – AI Cyber Defense Act

AI-Generated Summary

Updated October 23, 2026 at 10:52 AM UTC

The AI Cyber Defense Act directs the National Institute of Standards and Technology (NIST) to work with private‑sector AI companies to define "AI distillation attacks" and to develop voluntary standards and best practices for detecting and preventing those attacks. It also requires NIST to set up an AI Cybersecurity Roundtable that includes AI firms and owners of critical infrastructure to create defensive AI cybersecurity guidelines. The bill mainly affects AI developers, critical‑infrastructure operators, and foreign entities from certain listed countries.

Key Provisions

Within 180 days, NIST must engage private‑sector AI stakeholders to define AI distillation attacks and draft voluntary detection and prevention standards.
NIST must publish the voluntary standards and best practices for AI distillation attacks on its website within one year of their creation.
Within 180 days, NIST must establish an "AI Cybersecurity Roundtable" with private AI firms and critical‑infrastructure owners to develop voluntary defensive AI cybersecurity standards, which must be published within one year.
The bill defines key terms, including AI (as defined in the 2020 AI Initiative Act), "country of concern" (China, Russia, Iran, North Korea, Cuba), "entity of concern" (foreign persons or entities linked to those countries), and "private sector AI stakeholders" (non‑government businesses that develop or support AI systems and are not entities of concern).

Legislative Activity

Stay on top of the latest movement without scrolling through every action

1 earlier action

HouseIntro Referral Latest Action

Referred to the House Committee on Science, Space, and Technology.

Science, Space, and Technology Committee

October 22, 2026

View full timeline

HouseIntro Referral

Introduced in House

October 22, 2026

HouseIntro Referral

Referred to the House Committee on Science, Space, and Technology.

Science, Space, and Technology Committee

October 22, 2026

Bill Text

Latest available legislative text

Reading Mode

Raw Text PDF XML

Introduced in HouseIssued October 22, 2026

I

119th CONGRESS

2d Session

H. R. 10873

IN THE HOUSE OF REPRESENTATIVES

October 22, 2026

Mr. Harrigan (for himself and Mr. Whitesides) introduced the following bill; which was referred to the Committee on Science, Space, and Technology

A BILL

To require the National Institute of Standards and Technology to carry out certain activities regarding certain artificial intelligence attacks, and for other purposes.

1.

Short title

This Act may be cited as the AI Cyber Defense Act.

2.

NIST AI distillation and cybersecurity standards

(a)

In general

(1)

Engagement

Not later than 180 days after the date of the enactment of this Act, the Director of the National Institute of Standards and Technology (NIST) shall seek to engage with private sector artificial intelligence stakeholders to establish the following:

(A)

A definition for artificial intelligence distillation attacks.

(B)

Voluntary standards and best practices for the detection and prevention of such attacks.

(2)

Publication

Not later than one year after the establishment of voluntary standards and best practices under paragraph (1), the Director shall publish on the website of NIST such voluntary standards and best practices.

(b)

Standards and best practices

Not later than 180 days after the date of the enactment of this Act, the Director of NIST shall establish a roundtable, to be known as the AI Cybersecurity Roundtable (in this subsection referred to as the Roundtable), to develop voluntary standards and best practices relating to the defensive use of artificial intelligence for cybersecurity purposes. The Director shall seek representation on the Roundtable of private sector artificial intelligence stakeholders and owners and operators of critical infrastructure. Not later than one year after the establishment of the Roundtable, the Director shall publish on the website of NIST such voluntary standards and best practices.

(c)

Definitions

In this section:

(1)

Artificial intelligence

The term artificial intelligence has the meaning given such term in section 5002 of the Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).

(2)

Country of concern

The term country of concern means—

(A)

The People’s Republic of China, including the Hong Kong and Macau Special Administrative Regions.

(B)

The Russian Federation.

(C)

The Islamic Republic of Iran.

(D)

The Democratic People’s Republic of Korea.

(E)

The Republic of Cuba.

(3)

Critical infrastructure

The term critical infrastructure has the meaning given such term in section 1016(e) of Public Law 107–56 (42 U.S.C. 5195c(e)).

(4)

Entity of concern

(A)

In general

The term entity of concern means any foreign person or entity that—

(i)

is headquartered in, or the parent company of which is headquartered in, a country of concern;

(ii)

is operating under the direction or control of any entity headquartered in, or the parent company of which is headquartered in, a country of concern; or

(iii)

the Director of NIST determines to be an entity of concern for purposes of this section.

(B)

Exception

The term entity of concern does not include a person who—

(i)

lawfully admitted for permanent residence (as such term is defined in section 101(a) of the Immigration and Nationality Act (8 U.S.C. 1101(a))); or

(ii)

a citizen of the United States.

(5)

Private sector artificial intelligence stakeholders

The term private sector artificial intelligence stakeholders means any corporation, partnership, limited liability company, sole proprietorship, or other business entity that—

(A)

is not a unit, agency, instrumentality, or wholly owned enterprise of a Federal, State, local, or Tribal government;

(B)

develops, trains, deploys, offers, sells, or licenses one or more artificial intelligence systems, or provides substantial computing infrastructure, data, or technical services for the development or deployment of such systems, as part of its ordinary business activities does so for commercial purposes, including for profit, in exchange for consideration, or in furtherance of a business enterprise, regardless of whether such entity has yet generated revenue; and

(C)

is not an entity of concern.