H.R. 9125: Sectoral AI Governance Act of 2026

H.R. 9125, the Sectoral AI Governance Act of 2026, takes a decentralized approach to AI oversight. Instead of creating a brand-new federal AI agency, it authorizes the heads of agencies that already enforce federal law to issue rules on "algorithmic decision-making systems" when they determine those systems are "likely to materially contribute to violations of the Federal law." Those rules must be issued under the standard notice-and-comment process in 5 U.S.C. § 553, and if a company violates one of those AI rules, that violation is treated as a violation of the underlying federal law for administrative and civil enforcement.

The bill builds in a slower, more documented rulemaking process than agencies might otherwise use. In most cases, an agency has to publish an advanced notice of proposed rulemaking at least 60 days before it issues a formal proposed rule. That early notice must spell out the type of system at issue, the federal law involved, and the information or evidence the agency wants. There is an exception: the agency can skip that step if the agency head says an earlier rulemaking record started before enactment, or a prior ANPRM, already provides a sufficient record.

The measure also tries to prevent agencies from issuing clashing AI rules. Before acting, agencies must consult the Office of Information and Regulatory Affairs on overlap or conflict, and must also consult the Office of Science and Technology Policy and the National Institute of Standards and Technology on technical characteristics, evaluation, and governance. The Office of Management and Budget, through OIRA and in consultation with OSTP, must issue guidance to resolve conflicts and keep policy consistent. Agencies are also told to consider whether a rule could disrupt the delivery, accessibility, timeliness, integrity, or continuity of government services or public benefits, including services provided by contractors.

The bill is broad in scope but careful in definition. An "algorithmic decision-making system" includes computational processes using statistics, machine learning, artificial intelligence, or similar methods when they make a decision, execute a decision, or assist in one in a way that can alter the outcome. But it excludes "passive computing infrastructure" such as web hosting, domain registration, networking, caching, data storage, and cybersecurity, so the bill is aimed more at decision systems than at the internet plumbing behind them. Agencies would have to revisit any rule no later than 3 years after promulgation and then at least every 5 years after that, and they would have to report to Congress every 2 years starting 2 years after enactment, including staffing actions, enforcement summaries, aggregate penalty ranges, and disparate impact assessment summaries.