H.R. 10915 adds AI and deadlines to cloud bill

Update October 31, 2026: the latest coverage adds that H.R. 10915 targets critical infrastructure and includes artificial intelligence to detect anomalous activity. A summarized legislative timeline, along with deadlines for the voluntary certification program and the FedRAMP update, was also reported by Quiver Quantitative.

Richard McCormick introduced H.R. 10915 in the House of Representatives. Known as the Common-Sense Cloud Security Act, the bill directs NIST to update cloud security standards, adds artificial intelligence to detect anomalous activity, and sets up a voluntary certification scheme for providers. At the time of the source material reviewed for this article, the bill had no cosponsors. The proposal remains at an early stage, and the sources reviewed do not confirm implementation dates or penalties.

What does the bill include?

The proposal adds a method for measuring the blast radius of a breach across interconnected networks. It also calls for reports to Congress on private adoption of the standards and on barriers that could slow implementation. Politico said that component is intended to give lawmakers a more concrete reference point for the impact of an incident in connected environments.

How would certification work?

Security Today reported that the program would be tiered and voluntary, with assessments carried out by accredited independent labs. That design is meant to let providers undergo outside reviews without making certification an immediate requirement. The same source added that the bill also addresses monitoring third-party software integrations connected to core cloud platforms.

What did the latest coverage add?

Nextgov described H.R. 10915 as a federal effort to modernize cloud security standards for critical infrastructure. That coverage added that the text includes the use of artificial intelligence to detect anomalous activity and controls over third-party software integrations.

Quiver Quantitative also published a summarized legislative timeline that, according to its analysis, would depend on the bill becoming law. That schedule calls for an initial public consultation within 180 days of enactment, a draft standard 50 days later, and a final version 135 days after that.

The same source said NIST and CISA would create the voluntary certification program within one year of the final standards being published, while OMB would update FedRAMP within the same timeframe. Quiver Quantitative also dated the bill’s receipt to October 26, 2026, and said it had no cosponsors at that time.

How did industry react?

Aviatrix welcomed the bill and said standards should evolve alongside modern cloud architectures and AI-driven cyber threats. The company framed its support around the need for rules to keep pace with technical changes in cloud environments. That response was distributed through GlobeNewswire.

Aviatrix also described the proposal as a critical infrastructure initiative and said it includes recommendations to prevent, detect, and limit attacks within the cloud environment, including movement between workloads. In its analysis, the company also said the legislative text defines blast radius as the maximum potential reach of unauthorized access or system compromise stemming from a compromised workload, data asset, or credential, although that point should be verified against the official bill text.