James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, Section 1554 ("Roadmap and implementation plan for cyber adoption of artificial intelligence")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: NDAA provisions;U.S. federal laws
• Most recent activity: Enacted
• Most recent activity date: 2022-12-23

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Disinformation, surveillance, and influence at scale
• Competitive dynamics
• AI possessing dangerous capabilities
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal to good coverage of approximately 5-7 subdomains, with primary focus on AI system security (2.2), malicious actors and cyberattacks (4.1, 4.2), competitive dynamics (6.4), and AI system safety failures (7.2, 7.3). Coverage is concentrated in security, defense against adversarial AI, and capability development domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Scientific Research & Development Services

All other sectors had no coverage in this document.

Sectors Summary

This document primarily governs AI use within the National Security sector, specifically for Department of Defense cyber operations. It also has minimal coverage of Scientific Research and Development Services through references to DARPA's involvement in AI research for cyber applications.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative provision enacted by the United States Congress as part of the National Defense Authorization Act, containing mandatory requirements with specific deadlines and enforcement through congressional oversight mechanisms.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is Section 1554 of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, which is enacted by the United States Congress as the legislative authority.

Target

• Entity Types: AI_Governance_Actor, AI_Developer
• Entities: Commander of the United States Cyber Command; Chief Information Officer of the Department of Defense; Chief Digital and Artificial Intelligence Officer of the Department; Director of the Defense Advanced Research Projects Agency; Director of the National Security Agency; Under Secretary of Defense for Research and Engineering; Commander of Joint-Force Headquarters Department of Defense Information Networks; Secretaries of the military departments; Cyberspace Operations Forces of the Department of Defense
• Summary: The document targets specific Department of Defense officials and entities responsible for developing and implementing AI systems for cyber operations. These entities are both governance actors (in their regulatory/oversight roles) and AI developers (in their development and acquisition roles).

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: congressional defense committees; United States Congress
• Summary: The congressional defense committees serve as the enforcement body through oversight mechanisms, requiring mandatory briefings and monitoring compliance with the statutory requirements.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: congressional defense committees; Commander of the United States Cyber Command; Chief Information Officer of the Department of Defense
• Summary: The congressional defense committees monitor implementation through required briefings. The Commander and Chief Information Officer also have monitoring responsibilities for tracking progress against milestones and metrics.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers all AI lifecycle stages from planning through operational monitoring, with particular emphasis on the Plan and Design, Deploy, and Operate and Monitor stages. It requires development of a five-year roadmap covering identification, development, acquisition, adoption, and sustainment of AI systems for cyber operations.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems
• Open Weight / Open Source
• Task-specific AI

Technical Scope Summary

The document explicitly mentions AI systems and applications throughout, with focus on artificial intelligence systems for cyber operations. It does not specifically mention frontier AI, general purpose AI, foundation models, generative AI, predictive AI, or compute thresholds. There is no explicit mention of open-weight or open-source models.