William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, Division A, Title VIII, Section 801 ("Report on acquisition risk assessment and mitigation as part of Adaptive Acquisition Framework implementation")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: NDAA provisions;U.S. federal laws
• Most recent activity: Enacted
• Most recent activity date: 2021-01-01

Risk subdomain coverage

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Competitive dynamics
• AI possessing dangerous capabilities
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal coverage of approximately 3-4 subdomains, with focus on AI system security (2.2), competitive dynamics (6.4), and AI safety failures (7.2, 7.3). Coverage is concentrated in security vulnerabilities, supply chain risks, and system robustness concerns related to AI-enabled defense acquisition programs.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Professional & Technical Services
• Scientific Research & Development Services

All other sectors had no coverage in this document.

Sectors Summary

This document primarily governs the National Security sector, specifically addressing AI acquisition risks within Department of Defense programs. It does not regulate private sector AI development but rather internal DoD acquisition processes and risk management.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal statute enacted by the United States Congress as part of the National Defense Authorization Act for Fiscal Year 2021, with mandatory reporting requirements and specific deadlines for Department of Defense officials.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is Section 801 of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, which is federal legislation enacted by the United States Congress.

Target

• Entity Types: AI_Governance_Actor
• Entities: Department of Defense service acquisition executives; Secretary of Defense; Under Secretary of Defense for Acquisition and Sustainment; Under Secretary of Defense for Research and Engineering; Chief Information Officer of the Department of Defense
• Summary: The document explicitly targets Department of Defense service acquisition executives who must assess and report on acquisition risks, including those related to AI systems. The reporting obligations extend to multiple DoD leadership positions.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress; congressional defense committees
• Summary: Congress enforces compliance through its oversight authority via the congressional defense committees, which receive mandatory reports and can conduct oversight of DoD compliance with the reporting requirements.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: congressional defense committees; Under Secretary of Defense for Acquisition and Sustainment
• Summary: The congressional defense committees monitor implementation through receipt of reports. The Under Secretary of Defense for Acquisition and Sustainment also serves a monitoring role by collecting and reviewing input from service acquisition executives.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document covers multiple AI lifecycle stages with primary focus on Build and Use Model, Verify and Validate, Deploy, and Operate and Monitor stages. It addresses risks throughout the acquisition lifecycle including technical development, integration, testing, deployment, and sustainment of AI-enabled defense systems.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems

Technical Scope Summary

The document explicitly mentions AI systems and machine learning capabilities in the context of defense acquisition programs. It focuses on systems that use AI to continuously change and optimize performance across multiple domains. No specific AI model types, compute thresholds, or distinctions between frontier/general-purpose/task-specific AI are mentioned.