National Defense Authorization Act for Fiscal Year 2026, Section 245 ("Biological data for artificial intelligence")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: NDAA provisions;U.S. federal laws;FY2026 NDAA
• Most recent activity: Enacted
• Most recent activity date: 2025-12-18

Risk subdomain coverage

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• AI system security vulnerabilities
• Governance failure
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal coverage of approximately 3-4 subdomains, with focus on privacy compromise (2.1), AI system security vulnerabilities (2.2), and governance failure (6.5). Coverage is concentrated in data security, privacy protection, and governance framework domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Scientific Research & Development Services
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Health Care & Social Assistance

All other sectors had no coverage in this document.

Sectors Summary

This document primarily governs the National Security sector by establishing requirements for DoD-funded biological data resources. It also has implications for Scientific Research and Development Services through its requirements for research data management, and potentially Health Care through biological data handling requirements.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative act from the United States Congress with mandatory requirements and enforcement authority delegated to the Secretary of Defense.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is identified as a section of the National Defense Authorization Act for Fiscal Year 2026, which is proposed and enacted by the United States Congress.

Target

• Entity Types: AI_Developer, AI_Infrastructure_Provider
• Entities: Department of Defense; Secretaries of the military departments; heads of the research laboratories of each of the Armed Forces; relevant individuals and entities in the private sector and academia who have received funding for research from the Department of Defense
• Summary: The requirements apply to qualified biological data resources created by research entirely funded by the Department of Defense, affecting DoD-funded researchers and entities that create and store biological data for AI use.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Secretary of Defense
• Summary: The Secretary of Defense is explicitly designated as the authority responsible for developing and implementing the requirements, with consultation obligations to ensure compliance.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Secretary of Defense
• Summary: The Secretary of Defense is responsible for reviewing and incorporating existing Federal frameworks and standards, indicating ongoing monitoring and evaluation responsibilities.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Operate and Monitor

AI Lifecycle Summary

The document primarily focuses on the Collect and Process Data stage by establishing requirements for how biological data should be collected, stored, and structured to facilitate AI use. It also addresses the Plan and Design stage through requirements development and the Operate and Monitor stage through cybersecurity and privacy protections.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

No technical scope terms identified.

Technical Scope Summary

The document explicitly mentions artificial intelligence and advanced computational methods. It focuses on biological data resources that facilitate AI use but does not specify particular types of AI models or systems. No compute thresholds, frontier AI, or specific AI architectures are mentioned.