National Defense Authorization Act for Fiscal Year 2026, Section 6601 ("Artificial Intelligence security guidance")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: NDAA provisions;U.S. federal laws;FY2026 NDAA
• Most recent activity: Enacted
• Most recent activity date: 2025-12-18

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Lack of capability or robustness

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Competitive dynamics
• AI possessing dangerous capabilities

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 5-6 subdomains, with strong focus on AI system security (2.2), cyberattacks and weapons (4.2), competitive dynamics (6.4), dangerous capabilities (7.2), and lack of robustness (7.3). Coverage is concentrated in security, nation-state threats, and AI system vulnerabilities.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information
• Scientific Research & Development Services
• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

This document primarily governs National Security operations by requiring the NSA to develop AI security guidance. It also has implications for Scientific Research and Development Services and Information sectors through voluntary collaboration with research entities and private sector entities developing AI technologies.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative act from the United States Congress with mandatory language requiring the NSA Director to develop AI security guidance, using 'shall' throughout to establish legal obligations.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is Section 6601 of the National Defense Authorization Act for Fiscal Year 2026, which is proposed and enacted by the United States Congress as federal legislation.

Target

• Entity Types: AI_Governance_Actor, AI_Developer, AI_Infrastructure_Provider
• Entities: National Security Agency Director; departments and agencies of the United States Government; research entities; private sector entities
• Summary: The primary target is the NSA Director who must develop the guidance. Secondary targets include government agencies, research entities, and private sector entities who will receive and potentially implement the security guidance on a voluntary basis.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: National Security Agency Director
• Summary: The NSA Director is responsible for implementing the requirements of this section by developing, publishing, and updating the AI security guidance as mandated by the legislation.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: National Security Agency Director
• Summary: The NSA Director is implicitly responsible for monitoring through the requirement to update the guidance from time to time and through collaboration with various entities on AI model safety and security.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document covers multiple AI lifecycle stages with primary focus on Build and Use Model (identifying vulnerabilities in AI technologies), Deploy (protecting AI supply chains and deployment), and Operate and Monitor (detecting and responding to nation-state cyber threats). It also addresses Plan and Design through security strategy identification.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems

Technical Scope Summary

The document explicitly mentions 'artificial intelligence technologies', 'artificial intelligence systems', and 'advanced artificial intelligence' multiple times. It focuses on AI model safety and security but does not specify particular types of AI (frontier, general purpose, task-specific, etc.) or compute thresholds.