The Pentagon is required to submit a report to Congress by August 31, 2026, as mandated by Section 1512 of the fiscal 2026 defense authorization law. This report will review the department's practices regarding the security of artificial intelligence and machine-learning systems, including current practices, identified gaps, commercial security options, and recommendations for additional resources.
This report coincides with recent actions taken by the Trump administration, including Executive Order 14409, which aims to accelerate AI-enabled cyber defense without introducing new licensing requirements. Additionally, the Pentagon has suspended Phase II of the Cybersecurity Maturity Model Certification program to reduce compliance burdens while maintaining cybersecurity standards.
The upcoming report is expected to evaluate which AI-security controls effectively mitigate operational risks and should be enforceable contract terms. Congress has also directed the Pentagon to establish a risk-based security framework for AI systems, addressing issues such as supply chain risks and continuous monitoring.
The report will need to provide concrete evidence of security measures and their effectiveness, as the Justice Department has previously held contractors accountable for misrepresenting cybersecurity compliance. The Pentagon is working on institutional measures to ensure that AI security claims are substantiated and can be audited.
The report aims to identify practical controls that can be monitored and audited, along with a plan for integrating these controls into procurement requirements. The administration seeks to avoid regulatory measures that may hinder AI development without enhancing security.