US House members introduce a bill directing NIST to work on AI distillation attacks

The Congressional Record for 22 October 2026 lists H.R. 10873, introduced by Representative Pat Harrigan for himself and Representative George Whitesides, and referred to the House Committee on Science, Space, and Technology. The Record describes it as a bill to require the National Institute of Standards and Technology to carry out certain activities regarding certain artificial intelligence attacks, and for other purposes.

As reported by CyberScoop the same day, the bill is called the AI Cyber Defense Act. CyberScoop says it would direct NIST to develop voluntary industry standards and best practices for preventing distillation attacks from foreign entities in Russia, China, Iran and North Korea, and that NIST would have to define a distillation attack and separate it from sharing around open-weight and open-source models. CyberScoop says the bill would also set up an AI Cybersecurity Roundtable at NIST, with government and industry participants, to develop voluntary standards for defensive use of AI in cybersecurity for critical infrastructure. It says the bill defines an entity of concern as a foreign person or organisation headquartered in one of those four countries, or operating under the direction of a company based there, and that the NIST director could designate further individuals or organisations.

The bill has been introduced and referred to committee. It is not law.

What it means for business: no new duty. Model developers and critical-infrastructure operators would be asked to help with voluntary NIST standards only if the bill is enacted and NIST starts that work.