S2606 A bill to require the Commander of United States Cyber Command to complete development of a roadmap for industry collaboration on artificial intelligence-enabled cyber capabilities for cyberspace operations of the Department of Defense, and for…

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Proposed
• Most recent activity date: 2025-07-31

Risk subdomain coverage

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• AI possessing dangerous capabilities

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal coverage of risk domains, with primary focus on developing AI-enabled cyber capabilities rather than addressing AI risks. Limited implicit coverage of AI system security (2.2) and dangerous capabilities (7.2) through mentions of security clearances and capability development. The document is primarily a governance mechanism for capability development rather than a risk mitigation framework.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• Scientific Research & Development Services
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Professional & Technical Services

All other sectors had no coverage in this document.

Sectors Summary

The document primarily governs AI use in the National Security sector through Department of Defense cyberspace operations. It also has substantial coverage of the Information sector (cyber capabilities involve telecommunications and data systems), Professional and Technical Services (cybersecurity experts), and Scientific Research and Development Services (collaborative R&D partnerships with DARPA and Defense Innovation Unit).

Legislative Status

Hard Law

Legislative Status Summary

This is a Congressional bill that, once enacted, would create legally binding obligations on the Commander of U.S. Cyber Command and the Department of Defense. It contains mandatory language ('shall'), specific deadlines, and enforcement through Congressional oversight mechanisms.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is a Congressional bill, as indicated by the formal legislative language and structure. Congress is the proposing authority seeking to enact this legislation.

Target

• Entity Types: AI_Governance_Actor, AI_Developer
• Summary: The bill primarily targets the Commander of U.S. Cyber Command, who must develop the roadmap in coordination with multiple DoD entities. It also applies to commercial AI developers and cybersecurity experts who will be convened for collaboration, and establishes requirements for industry engagement and partnerships.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: Enforcement is conducted through Congressional oversight, with the Commander required to provide mandatory briefings to the congressional defense committees. This oversight mechanism ensures compliance with the roadmap development and implementation requirements.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The congressional defense committees serve as the primary monitoring body, receiving both an initial briefing on the completed roadmap and annual updates on implementation status through 2030.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers multiple AI lifecycle stages with primary focus on Plan and Design (roadmap development, strategy formulation), Build and Use Model (collaborative R&D partnerships, development lines of effort), and Deploy (technology transition mechanisms, operational integration). It also addresses Operate and Monitor through ongoing collaboration activities and annual status updates. The document does not address data collection and processing stages.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems

Technical Scope Summary

The document explicitly references 'artificial intelligence-enabled cyber capabilities' and 'artificial intelligence capabilities' multiple times, clearly indicating coverage of AI systems and capabilities. However, it does not specify particular categories such as frontier AI, general purpose AI, foundation models, or compute thresholds. The focus is on AI capabilities for cyber operations without technical categorization.