National Defense Authorization Act for Fiscal Year 2026, Section 1513 ("Physical and cybersecurity procurement requirements for artificial intelligence systems")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: NDAA provisions;U.S. federal laws;FY2026 NDAA
• Most recent activity: Enacted
• Most recent activity date: 2025-12-18

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Competitive dynamics
• Lack of capability or robustness

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• AI possessing dangerous capabilities

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 5-6 subdomains, with strong focus on AI system security vulnerabilities (2.2), malicious actors and cyberattacks (4.2), competitive dynamics (6.4), and AI system robustness (7.3). Coverage is concentrated in security, supply chain risks, and system reliability domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information
• Professional & Technical Services
• Scientific Research & Development Services
• Educational Services

All other sectors had no coverage in this document.

Sectors Summary

This document primarily governs the National Security sector, specifically the Department of Defense's procurement and use of AI systems. It also has implications for Professional and Technical Services, Scientific Research and Development Services, and Information sectors through requirements on contractors that develop, deploy, store, or host AI/ML technologies for the DoD.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative instrument enacted by the United States Congress as part of the National Defense Authorization Act. It contains mandatory requirements with enforcement mechanisms through federal acquisition regulations.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is Section 1513 of the National Defense Authorization Act for Fiscal Year 2026, which is enacted by the United States Congress as the legislative authority.

Target

• Entity Types: AI_Developer, AI_Deployer, AI_Infrastructure_Provider
• Entities: Department of Defense; covered entities (contractors developing, deploying, storing, or hosting AI/ML technologies for DoD)
• Summary: The document explicitly targets 'covered entities' which are defined as entities that contract with the Department of Defense to develop, deploy, store, or host AI and machine learning technologies. The DoD itself is also a target as it must implement the framework.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Secretary of Defense; Department of Defense
• Summary: The Secretary of Defense is explicitly designated as the enforcement authority who must develop the framework, amend acquisition regulations, and ensure compliance by covered entities through the Defense Federal Acquisition Regulation Supplement.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Secretary of Defense; congressional defense committees
• Summary: The Secretary of Defense is responsible for continuous monitoring and incident reporting procedures. Congressional defense committees receive reports on implementation status, providing legislative oversight.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers multiple AI lifecycle stages with particular emphasis on Build and Use Model, Verify and Validate, Deploy, and Operate and Monitor stages. It addresses security throughout the development and deployment lifecycle, including supply chain risks, training requirements, and continuous monitoring.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems

Technical Scope Summary

The document explicitly covers AI systems and machine learning technologies broadly, with specific focus on highly capable AI systems. It does not distinguish between frontier AI, general purpose AI, or task-specific AI, but addresses AI/ML systems acquired by the Department of Defense comprehensively. No compute thresholds or open-weight model distinctions are mentioned.