National Defense Authorization Act for Fiscal Year 2026, Section 5303 ("Reports on technology transformation projects at the department")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: NDAA provisions;U.S. federal laws;FY2026 NDAA
• Most recent activity: Enacted
• Most recent activity date: 2025-12-18

Risk subdomain coverage

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Governance failure
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal coverage of AI risk domains, with limited implicit references to governance failure (6.5) and system safety/robustness (7.3). The document primarily focuses on reporting and oversight mechanisms for technology projects rather than addressing specific AI risks or harms. Coverage is concentrated in governance and monitoring requirements rather than substantive risk mitigation.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• National Security

All other sectors had no coverage in this document.

Sectors Summary

This document primarily governs the Public Administration sector, specifically the Department of State's technology transformation projects. It does not regulate private sector activities but rather establishes internal government reporting and oversight requirements for technology deployment including AI systems within diplomatic and consular operations.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative provision enacted by the United States Congress as part of the National Defense Authorization Act, containing mandatory reporting requirements with specific timelines and enforcement through congressional oversight mechanisms.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is a section of the National Defense Authorization Act for Fiscal Year 2026, which is proposed and enacted by the United States Congress as indicated by the authority designation.

Target

• Entity Types: AI_Governance_Actor, AI_Developer, AI_Deployer
• Entities: Department of State (the Secretary); technology vendors; artificial intelligence model providers; cloud providers; cybersecurity platforms; software component providers
• Summary: The document applies to the Secretary (Department of State) who must report on technology transformation projects, and indirectly governs the vendors and technology providers whose systems are deployed by the Department, including AI developers and deployers.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Committee on Foreign Affairs of the House of Representatives; Committee on Appropriations of the House of Representatives; Committee on Foreign Relations of the Senate; Committee on Appropriations of the Senate; United States Congress
• Summary: The appropriate congressional committees receive mandatory reports and have oversight authority. Congress has the power to enforce compliance through its legislative and budgetary authority over the Department.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Government Accountability Office; Comptroller General of the United States; Committee on Foreign Affairs of the House of Representatives; Committee on Appropriations of the House of Representatives; Committee on Foreign Relations of the Senate; Committee on Appropriations of the Senate
• Summary: The Government Accountability Office is explicitly tasked with evaluating the Department's implementation and reporting on technology projects. The congressional committees also monitor through receipt and review of reports.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document covers multiple AI lifecycle stages with primary focus on Deploy and Operate and Monitor stages. It requires reporting on deployment metrics, post-implementation performance, and ongoing monitoring of technology projects including AI systems. There is also coverage of Verify and Validate through requirements for performance metrics and effectiveness evaluation.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems

Technical Scope Summary

The document explicitly mentions artificial intelligence and machine learning systems as a category of technology covered. It does not define or distinguish between different types of AI (frontier, general purpose, task-specific, foundation models, generative, or predictive). There is no mention of compute thresholds or open-weight models. The focus is on technology transformation projects broadly, with AI as one component.