National Defense Authorization Act for Fiscal Year 2026, Section 1532 ("Guidance and prohibition on use of certain artificial intelligence")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: NDAA provisions;U.S. federal laws;FY2026 NDAA
• Most recent activity: Enacted
• Most recent activity date: 2025-12-18

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Competitive dynamics
• Governance failure

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Disinformation, surveillance, and influence at scale
• Cyberattacks, weapon development or use
• AI possessing dangerous capabilities
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on AI system security (2.2), malicious actors and national security threats (4.1, 4.2), competitive dynamics (6.4), governance failure (6.5), and AI safety failures (7.2, 7.3). Coverage is concentrated in security, national security risks, and system safety domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Scientific Research & Development Services

All other sectors had no coverage in this document.

Sectors Summary

This document exclusively governs the National Security sector, specifically the Department of Defense and its contractors. It prohibits the use of certain AI systems developed by covered companies within defense operations and contracting.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal statute enacted by the United States Congress as part of the National Defense Authorization Act, with mandatory prohibitions, enforcement mechanisms, and legal obligations on the Department of Defense and its contractors.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is Section 1532 of the National Defense Authorization Act for Fiscal Year 2026, which is enacted by the United States Congress as the legislative authority.

Target

• Entity Types: AI_Governance_Actor, AI_Deployer, AI_Developer
• Entities: Department of Defense; Department of Defense contractors; DeepSeek; High Flyer; covered artificial intelligence companies
• Summary: The document explicitly targets the Department of Defense and its contractors, prohibiting them from using covered AI. It also identifies specific AI developers (DeepSeek, High Flyer) and covered AI companies as regulated entities.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Secretary of Defense; Department of Defense
• Summary: The Secretary of Defense is explicitly granted authority to require exclusion and removal of covered AI, issue guidance, grant waivers, and take necessary risk mitigation steps.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Secretary of Defense; Department of Defense; International Trade Administration of the Department of Commerce
• Summary: The Secretary of Defense has monitoring authority through determination of national security risks and oversight of the National Industrial Security Program. The document references existing monitoring mechanisms like the Consolidated Screening List and civil-military fusion list.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily focuses on the Deploy and Operate and Monitor stages, with explicit requirements for exclusion and removal of covered AI from operational systems and ongoing monitoring of national security risks. It also implicitly covers Verify and Validate through evaluation and testing provisions in waiver conditions.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems

Technical Scope Summary

The document explicitly defines and covers artificial intelligence broadly, referencing existing federal definitions. It does not distinguish between AI models and AI systems, frontier AI, general purpose AI, or other specific AI categories. No compute thresholds are mentioned. The focus is on the origin and ownership of AI rather than technical characteristics.