National Defense Authorization Act for Fiscal Year 2026, Section 907 ("Defense science board study on optimal organizational structure for digital solution and software delivery")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: NDAA provisions;U.S. federal laws;FY2026 NDAA
• Most recent activity: Enacted
• Most recent activity date: 2025-12-18

Risk subdomain coverage

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Governance failure

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

This document has minimal to no coverage of AI risk domains. It is primarily a procedural directive requiring a study on organizational structure for software delivery within the Department of Defense. While it mentions AI systems in the context of organizational management (governance structures for AI model management), it does not address specific AI risks, harms, or safety concerns outlined in the MIT taxonomy.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• National Security

All other sectors had no coverage in this document.

Sectors Summary

This document governs AI and digital solutions engineering within the National Security sector, specifically within the Department of Defense. It addresses organizational structures for software delivery and AI model management in military and defense contexts.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative provision from the National Defense Authorization Act, using mandatory language ('shall') to require the Secretary of Defense to direct a study. It is enacted by Congress with legal force.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is Section 907 of the National Defense Authorization Act for Fiscal Year 2026, which is enacted by the United States Congress as the legislative authority.

Target

• Entity Types: AI_Governance_Actor
• Entities: Secretary of Defense; Defense Science Board; Office of the Secretary of Defense; Department of Defense; software delivery organizations
• Summary: The document directs the Secretary of Defense to commission a study from the Defense Science Board, evaluating organizational structures within the Office of the Secretary of Defense for digital solutions and software delivery across the Department of Defense.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Congressional defense committees; Secretary of Defense
• Summary: The Secretary of Defense is responsible for ensuring the study is conducted and reported, while congressional defense committees provide oversight through mandatory reporting requirements.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Congressional defense committees; Secretary of Defense
• Summary: Congressional defense committees monitor implementation through mandatory reporting, and the Secretary of Defense monitors the Defense Science Board's completion of the study with specified deadlines.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document addresses organizational structures for managing AI systems throughout their lifecycle, with particular emphasis on deployment and operational monitoring. It covers planning and design through its focus on organizational structure recommendations, and addresses ongoing operations through requirements for AI model management governance structures.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems

Technical Scope Summary

The document explicitly mentions AI systems and AI model management as part of digital solutions engineering. It does not specify particular types of AI (frontier, general purpose, task-specific, generative, or predictive) nor does it mention compute thresholds or open-weight models. The focus is on organizational structures for managing AI systems broadly.