National Defense Authorization Act for Fiscal Year 2026, Section 1515 ("Incorporation of artificial intelligence considerations into cybersecurity training")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: NDAA provisions;U.S. federal laws;FY2026 NDAA
• Most recent activity: Enacted
• Most recent activity date: 2025-12-18

Risk subdomain coverage

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Competitive dynamics

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal coverage of 2-3 subdomains, with focus on AI system security vulnerabilities (2.2), cyberattacks and weapons (4.2), and potentially competitive dynamics (6.4). Coverage is concentrated narrowly on cybersecurity training related to AI threats in a military context.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• National Security

All other sectors had no coverage in this document.

Sectors Summary

This document exclusively governs the National Security sector, specifically mandating cybersecurity training related to AI for Department of Defense personnel. No other economic sectors are regulated by this provision.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding statutory provision enacted by Congress with mandatory language requiring the Secretary of Defense to take specific action within a defined timeframe.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is identified as a section of the National Defense Authorization Act for Fiscal Year 2026, which is enacted by the United States Congress as the legislative authority.

Target

• Entity Types: AI_Governance_Actor, AI_User
• Entities: Secretary of Defense; Chief Information Officer of the Department of Defense; members of the Armed Forces; civilian employees of the Department of Defense
• Summary: The document requires the Secretary of Defense to revise cybersecurity training for Armed Forces members and civilian employees, making these groups the direct targets of the governance measure.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Secretary of Defense; Chief Information Officer of the Department of Defense; United States Congress
• Summary: The Secretary of Defense, through the Chief Information Officer, is responsible for implementing the training revision. Congress maintains oversight authority as the enacting body.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: United States Congress; Department of Defense
• Summary: Congress will monitor compliance through its oversight functions. The Department of Defense will internally monitor implementation of the revised training program.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document focuses primarily on the Deploy and Operate and Monitor stages, as it mandates training for personnel who will use and interact with AI systems in cybersecurity contexts. It does not address earlier stages like design, data collection, or model building.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

No technical scope terms identified.

Technical Scope Summary

The document refers to 'artificial intelligence' in general terms without defining it or specifying particular types of AI systems, models, or technical thresholds. The focus is on cybersecurity challenges posed by AI use rather than technical AI classifications.