Servicemember Quality of Life Improvement and National Defense Authorization Act for Fiscal Year 2025, Section 1515 ("Protective measures for mobile devices within the Department of Defense")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: FY2025 NDAA;NDAA provisions
• Most recent activity: Enacted
• Most recent activity date: 2024-12-23

Risk subdomain coverage

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Fraud, scams, and targeted manipulation
• Governance failure

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal coverage of approximately 3-4 subdomains, with focus on AI system security (2.2), cyberattacks and weapons (4.2), fraud and manipulation (4.3), and potentially governance failure (6.5). Coverage is concentrated in security and malicious actor domains, specifically addressing defensive measures against AI-enabled threats.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• National Security

All other sectors had no coverage in this document.

Sectors Summary

This document exclusively governs the National Security sector, specifically addressing cybersecurity measures for mobile devices within the Department of Defense. It mandates evaluation of protective technologies against AI-driven threats for military and defense operations.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative provision enacted by the United States Congress as part of the National Defense Authorization Act for Fiscal Year 2025, with mandatory obligations on the Secretary of Defense to conduct evaluations and submit reports.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is Section 1515 of the Servicemember Quality of Life Improvement and National Defense Authorization Act for Fiscal Year 2025, which is enacted by the United States Congress as the legislative authority.

Target

• Entity Types: AI_Governance_Actor
• Entities: Department of Defense; Secretary of Defense
• Summary: The document explicitly targets the Department of Defense and the Secretary of Defense, who are required to carry out evaluations of cybersecurity products and services for mobile devices, including AI-driven protective measures.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Congressional defense committees
• Summary: The congressional defense committees serve as the enforcement body through their oversight role, receiving mandatory reports on the evaluation findings and having authority to review compliance with the statutory requirements.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Congressional defense committees
• Summary: The congressional defense committees monitor implementation through the mandatory reporting requirement, which includes findings of the evaluation and determinations about technology procurement and incorporation.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Verify and Validate stage through evaluation of cybersecurity technologies, and the Deploy stage through assessment of feasibility and integration. It also touches on Operate and Monitor through consideration of endpoint detection and ongoing protection measures.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• Generative AI

Technical Scope Summary

The document explicitly mentions generative artificial intelligence in the context of smishing, phishing, and business email compromise protection. It does not define AI models or systems, nor does it mention frontier AI, general purpose AI, foundation models, compute thresholds, or open-weight models.