National Defense Authorization Act for Fiscal Year 2026, Section 1512 ("Artificial intelligence and machine learning security in the Department of Defense")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: NDAA provisions;U.S. federal laws;FY2026 NDAA
• Most recent activity: Enacted
• Most recent activity date: 2025-12-18

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Governance failure
• Lack of capability or robustness

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• Fraud, scams, and targeted manipulation
• Competitive dynamics
• AI possessing dangerous capabilities

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 5-6 subdomains, with strong focus on AI system security vulnerabilities (2.2), malicious actors and cyberattacks (4.2), governance failure (6.5), and AI system safety/robustness (7.3). Coverage is concentrated in security, threat mitigation, and governance domains specific to Department of Defense AI/ML systems.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• National Security

All other sectors had no coverage in this document.

Sectors Summary

This document exclusively governs AI/ML use within the National Security sector, specifically within the Department of Defense. It establishes comprehensive cybersecurity and governance requirements for AI systems used in national defense applications, with no coverage of other economic sectors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative instrument enacted by the United States Congress as part of the National Defense Authorization Act, containing mandatory requirements with specific deadlines and enforcement through the Department of Defense's authority structure.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is Section 1512 of the National Defense Authorization Act for Fiscal Year 2026, which is proposed and enacted by the United States Congress as indicated by the title and legislative format.

Target

• Entity Types: AI_Governance_Actor, AI_Developer, AI_Deployer
• Entities: Department of Defense; personnel of the Department of Defense
• Summary: The policy explicitly targets the Department of Defense and its workforce, requiring them to implement cybersecurity measures for AI/ML systems used in national defense applications and to ensure personnel are trained to identify and mitigate AI-specific vulnerabilities.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Secretary of Defense; Committees on Armed Services of the House of Representatives and the Senate
• Summary: The Secretary of Defense is designated as the primary enforcer responsible for developing, implementing, and reviewing the policy. Congressional oversight is provided through the Committees on Armed Services, which receive mandatory reports.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Secretary of Defense; Committees on Armed Services of the House of Representatives and the Senate
• Summary: The Secretary of Defense is required to conduct a comprehensive review to assess the effectiveness of AI/ML cybersecurity practices and report findings to Congressional committees, establishing both executive and legislative monitoring mechanisms.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document explicitly covers multiple AI lifecycle stages with particular emphasis on deployment, operation and monitoring. It addresses security measures throughout the entire lifecycle, from development through operational use, with detailed requirements for testing, auditing, monitoring, and governance of AI/ML systems in national defense applications.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems

Technical Scope Summary

The document explicitly mentions both AI systems and machine learning throughout, with specific focus on models for AI and ML. It addresses AI/ML used in national defense applications but does not explicitly distinguish between frontier AI, general purpose AI, task-specific AI, foundation models, generative AI, or predictive AI. There is no mention of compute thresholds or open-weight/open-source models.