National Defense Authorization Act for Fiscal Year 2026, Section 8521 ("Prohibition and notification on investments relating to covered national security transactions")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: NDAA provisions;U.S. federal laws;FY2026 NDAA
• Most recent activity: Enacted
• Most recent activity date: 2025-12-18

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Disinformation, surveillance, and influence at scale
• Cyberattacks, weapon development or use
• Competitive dynamics
• AI possessing dangerous capabilities

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Governance failure

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on malicious actors (4.1, 4.2), AI system security (2.2), competitive dynamics (6.4), governance failure (6.5), and dangerous capabilities (7.2). Coverage is concentrated in security, national security threats, and governance domains related to preventing adversarial technology development.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• Scientific Research & Development Services
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Finance & Insurance
• Real Estate, Rental & Leasing

All other sectors had no coverage in this document.

Sectors Summary

This document governs investment transactions across multiple sectors where AI and other advanced technologies are developed and deployed. The primary focus is on restricting U.S. investments in prohibited and notifiable technologies (AI systems, semiconductors, quantum computing, etc.) in countries of concern. The governance applies broadly to any sector where these technologies enable military, intelligence, surveillance, or cyber capabilities, with particular emphasis on Information (technology development), Scientific Research and Development Services, Manufacturing (semiconductors), and National Security sectors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal statute enacted by the United States Congress as part of the National Defense Authorization Act for Fiscal Year 2026. It contains mandatory prohibitions, enforcement mechanisms with civil penalties, and regulatory authority delegated to the Secretary of the Treasury.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is Section 8521 of the National Defense Authorization Act for Fiscal Year 2026, which is federal legislation enacted by the United States Congress.

Target

• Entity Types: AI_Developer, AI_Deployer, AI_Infrastructure_Provider
• Entities: United States persons engaging in covered national security transactions with covered foreign persons in countries of concern (People's Republic of China, Republic of Cuba, Islamic Republic of Iran, Democratic People's Republic of Korea, Russian Federation, Bolivarian Republic of Venezuela)
• Summary: The document explicitly targets United States persons (citizens, permanent residents, and entities organized under U.S. law) who engage in investments or transactions involving prohibited or notifiable technologies with covered foreign persons in countries of concern.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Secretary of the Treasury; Attorney General of the United States; Secretary of Commerce; Secretary of State
• Summary: The Secretary of the Treasury is designated as the primary enforcement authority with power to prohibit transactions, impose civil penalties, and compel divestment. The Attorney General can seek judicial relief. Other cabinet secretaries have consultative roles.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Secretary of the Treasury; Secretary of Commerce; appropriate congressional committees (Committee on Financial Services, Committee on Foreign Affairs, Committee on Banking, Housing, and Urban Affairs)
• Summary: The Secretary of the Treasury is required to monitor compliance through notification processes, identify non-notified activity, and submit annual reports to Congress. Congressional committees receive reports and testimony on implementation and enforcement.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Build and Use Model
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document does not focus on specific AI lifecycle stages but rather on investment transactions and technology transfer restrictions. It addresses the deployment and operational context by prohibiting and requiring notification of investments in prohibited and notifiable AI technologies. The governance applies across the lifecycle by restricting capital flows that could enable development of AI systems with military, intelligence, or surveillance capabilities.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems

Technical Scope Summary

The document explicitly covers AI systems as a prohibited and notifiable technology category. It does not define specific AI model types (frontier, general purpose, task-specific, foundation, generative, predictive) but broadly addresses 'Artificial intelligence systems' as a technology area subject to investment restrictions. No compute thresholds or open-weight model distinctions are mentioned.