National Defense Authorization Act for Fiscal Year 2024, Section 7356 ("Analysis of commercial cloud initiatives of intelligence community")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: NDAA provisions;U.S. federal laws
• Most recent activity: Enacted
• Most recent activity date: 2023-12-22

Risk subdomain coverage

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

This document has minimal to no coverage of AI risk domains. It is a procedural mandate requiring analysis and briefing on commercial cloud initiatives, with only a brief reference to AI workload support capabilities. No specific AI risks, harms, or mitigation measures are addressed.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• National Security

All other sectors had no coverage in this document.

Sectors Summary

This document governs AI infrastructure use within the National Security sector, specifically addressing commercial cloud initiatives and AI workload support for intelligence community elements. It does not regulate private sector activities or other economic sectors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding statutory provision enacted by the U.S. Congress as part of the National Defense Authorization Act for Fiscal Year 2024, containing mandatory obligations with specific deadlines and enforcement through congressional oversight mechanisms.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is Section 7356 of the National Defense Authorization Act for Fiscal Year 2024, which is enacted by the United States Congress as the legislative authority.

Target

• Entity Types: AI_Governance_Actor, AI_Infrastructure_Provider
• Entities: Director of National Intelligence; elements of the intelligence community; Director of the Central Intelligence Agency
• Summary: The document targets the Director of National Intelligence and intelligence community elements who are required to conduct the analysis and provide briefings. These entities are both governance actors (intelligence agencies) and infrastructure providers (operating commercial cloud services).

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: congressional intelligence committees; Committee on the Appropriations of the Senate; Committee on Appropriations of the House of Representatives
• Summary: Congressional committees are designated as the oversight and enforcement bodies who receive the mandatory briefing and have authority to ensure compliance with the statutory requirement.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: congressional intelligence committees; Committee on the Appropriations of the Senate; Committee on Appropriations of the House of Representatives
• Summary: The same congressional committees that enforce also monitor implementation through the required briefing on findings, which allows them to track and evaluate the intelligence community's commercial cloud initiatives and AI capabilities.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Collect and Process Data
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Deploy and Operate and Monitor stages of the AI lifecycle, focusing on infrastructure readiness and operational support for AI workloads within the intelligence community's commercial cloud environment. It does not substantively cover earlier stages like planning, data collection, or model building.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

No technical scope terms identified.

Technical Scope Summary

The document explicitly mentions artificial intelligence in the context of workload support and infrastructure requirements. It does not define or distinguish between different types of AI (frontier, general purpose, task-specific, etc.) or mention compute thresholds, foundation models, or open-source models. The focus is on AI as a workload type requiring cloud infrastructure support.