Insider Threat Reporting and Security Guidance Act of 2026
AI-generated text. This page was generated using artificial intelligence.
Insider Threat Reporting and Security Guidance Act of 2026.[1]
United States federal.[2]
Proposed legislation.[2]
S. 5601, 119th Congress.[1]
Introduced September 29, 2026; referred to Senate Armed Services.[2]
Proposed regulatory and guidance deadlines measured from enactment.[1]
October 9, 2026: complete introduced text, status record and embedded oversight letter reviewed.
The Insider Threat Reporting and Security Guidance Act of 2026 is S. 5601, a proposed federal bill introduced by Senator Jim Banks with Senator Kirsten Gillibrand on September 29, 2026. It was read twice and referred to Senate Armed Services.[1][2]
Covered contractors
The proposal covers contractors with at least $100 million in total Defense Department AI-system or AI-service contracts, including contractors seeking such contracts. A covered contractor must also have at least $1 billion in AI research-and-development spending over the preceding three years, aggregated with controlled or affiliated persons, or use a model developed or controlled by a person meeting that spending threshold.[1]
Reporting requirements
Within 180 days after enactment, the Secretary of Defense would issue reporting regulations. Contractors would report security practices, personnel vetting, insider-threat controls, supply-chain safeguards and sensitive-asset access; material incidents and vulnerabilities; defense-relevant capabilities and misuse risks; concerning model behavior; and other acute national-security risks. Initial submissions would accompany contract offers or bids, with certifications of material accuracy and completeness at least every 90 days.[1]
Acute national-security risks would trigger notification within 72 hours after awareness. The Secretary would distribute notifications to relevant defense officials and provide Armed Services committee notice within seven days after receipt, followed by material updates. Regulations would protect classified, proprietary and security-sensitive information.[1]
Voluntary guidance and congressional oversight
The Secretary would issue voluntary insider-risk guidance within 180 days, then assess risks and update the guidance within one year. Suggested safeguards would address sensitive roles and access, vetting, compartmentation, logging, monitoring and incident escalation. The text expressly makes adoption of those guidance measures voluntary. A separate unclassified implementation report, potentially accompanied by a classified annex, would go to the congressional defense committees within one year.[1]
October 7, 2026 oversight letter
Banks separately wrote to Secretary Pete Hegseth and OMB Director Russell Vought seeking stronger protection of military AI partnerships. He requested a staff briefing on insider risks, existing departmental efforts and gaps, and additional funding or personnel. The letter advocates government–industry cooperation and access to information about company security practices.[3]
Status and related coverage
GovInfo's latest recorded action is the September 29 Armed Services referral.[2] The regulatory and reporting deadlines above are contingent on enactment.[1]
- October 8 digest: Banks oversight letter
- United States Federal Authorities
- Government use and procurement
- United States policy on catastrophic AI risk
References
- ↑ 1.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 GovInfo, S. 5601 introduced text, September 29, 2026, sections 1–2; full body reviewed October 9, 2026.
- ↑ 2.0 2.1 2.2 2.3 2.4 GovInfo congressional bill-status record, S. 5601, checked October 9, 2026.
- ↑ Office of Senator Jim Banks, October 7, 2026 announcement and full embedded letter to Secretary Hegseth and OMB Director Vought.