NDAA FY2026 AI Provisions

Law & policy information

Name
NDAA FY2026 AI Provisions

Jurisdiction
United States — Federal

Instrument type
Legislation

Bill / legal citation
Pub. L. 119-60

Legislative or adoption status
See the dated record below.

Effective dates
See the timeline and source documents below.

Last source verification
Not recorded as a single article-wide date; see the dated source notes.

Overview

The NDAA FY2026 AI Provisions are provisions of the National Defense Authorization Act for Fiscal Year 2026, enacted as Public Law 119-60 on December 18, 2025.

Legislative details

• Parent Act: National Defense Authorization Act for Fiscal Year 2026
• Public Law: Pub. L. 119-60
• Bill Number: S. 1071 (119th Congress)
• Signed: December 18, 2025

Legislative history

The FY2026 NDAA was the product of extensive negotiations between the House and Senate Armed Services Committees. The House Armed Services Committee passed its version 55-2, and the Senate Armed Services Committee advanced its version 26-1 on July 9, 2025. Both chambers debated the bills on the floor through September 2025 with hundreds of amendments. The final bill was approved on December 18, 2025.

Requirements

Subtitle D — Artificial Intelligence (Title XV)

Section 1531 — Data Centers

Modifies the FY2025 NDAA high-performance computing roadmap to require the Secretary of Defense to ensure data centers installed on military installations consider energy and usage requirements.

Section 1532 — Covered AI systems and contractor use

Section 1532 directs the Secretary of Defense to require removal of covered AI from department systems and devices within 30 days of enactment, subject to case-by-case waivers. Covered AI includes models developed by DeepSeek and specified High Flyer-related entities. The contractor prohibition applies to use in performing a Defense Department contract; it is not a general ban on all contractor activity.

For the broader category of covered AI companies, including specified listed entities and companies domiciled in a covered nation, the Secretary must consider removal guidance for AI determined to pose a national-security risk. Contractor restrictions for that broader category depend on issuance of the guidance. The statute therefore distinguishes its express DeepSeek/High Flyer coverage from the broader guidance mechanism.

Waivers may cover qualifying research; evaluation, training, testing or analysis needed for national security; operational military activities supporting national security; or mission-critical functions. The Secretary must take measures considered necessary to mitigate waiver-related risks.

Section 1533 — AI Model Assessment Team

Directs the Secretary of Defense to:

• Establish a cross-functional team for AI model assessment and oversight by June 2026
• Develop a department-wide assessment framework by June 2027 including:
  • Standards for performance
  • Testing procedures
  • Security requirements
  • Ethical use principles

Section 1534 — AI Sandbox Environments

Requires the Secretary of Defense to create a task force to develop and deploy AI sandbox environments — isolated computing environments for AI experimentation, training, and development. Must create standard requirements department-wide.

Section 1535 — AI Futures Steering Committee

Creates the Artificial Intelligence Futures Steering Committee to:

• Shape long-term AI strategy
• Identify emerging technologies
• Recommend investments in research, workforce, and ethics
• Focus on general AI and transformative capabilities

Subtitle B — Cybersecurity (AI-Specific)

Section 1512 — AI/ML Cybersecurity Policy

Requires a comprehensive cybersecurity and governance policy for all DOD AI/ML systems, addressing risks including:

• Counterfeit parts
• Data poisoning
• Jailbreaks
• Unauthorized access

Section 1513 — AI Procurement Security

Directs development of physical and cybersecurity procurement requirements to mitigate risk for covered DOD AI/ML systems.

Section 1515 — AI in Cybersecurity Training

Requires incorporation of AI considerations into DOD cybersecurity training for personnel.

Intelligence Community AI Provisions

= Section 6602 — IC AI Governance

• IC CIO and Chief AI Officer must identify commonly used AI systems/functions reusable across IC elements
• Each Chief Intelligence Officer must create policies for sharing custom-developed code
• Section 6602(e) directs evaluation of procured and element-developed AI, evaluating "efficacy, safety, fairness, transparency, accountability, appropriateness, lawfulness, and trustworthiness"
• Section 6602(d) requires development of model contractual terms addressing technical data rights and minimizing dependency on proprietary information
• Rule of construction: Nothing authorizes directing a vendor to "alter a model to favor a particular viewpoint" — aligns with Executive Order 14319 on Preventing Woke AI

Section 6603 — Publicly Available AI Models

Addresses hosting publicly available models (e.g., ChatGPT, Google Gemini) in classified environments. Requires AI testing standards evaluating performance, efficacy, safety, fairness, transparency, accountability, appropriateness, lawfulness, and trustworthiness.

Section 6604 — DeepSeek Removal

DNI and IC heads must create guidelines requiring removal of DeepSeek from national security systems.

Autonomous Weapons Oversight

Section 1654 — Missile Defense Subscription Prohibition

Prohibits the Secretary of Defense from developing or operating missile defense systems with kinetic capabilities using subscription-based, pay-for-service, or recurring-fee models to engage or intercept targets — deemed "inherently governmental functions."

Section 1061 — Autonomous Weapons Waiver Reporting

Requires the Pentagon to report waivers of DOD Directive 3000.09 (safeguards for autonomous/semi-autonomous weapons) to congressional defense committees, including descriptions of weapons systems, rationale, and anticipated duration.

Other AI Provisions

Section 8521 — Defense Production Act Amendments

Amends the Defense Production Act to direct Treasury to update outbound investment rules:

• Add countries to specified countries of concern: Cuba, Iran, North Korea, Russia, Venezuela
• Expand covered foreign parties
• Impose restrictions on national security-related transactions

Significance

The article covers several distinct statutory mechanisms:

• Section 1532 distinguishes directly covered DeepSeek/High Flyer AI from the broader risk-based guidance mechanism, with contract-performance limits and waiver provisions.
• The AI Model Assessment Team (Section 1533) creates a statutory framework for DOD-wide AI evaluation, moving beyond the voluntary guidelines of previous NDAAs
• The "viewpoint neutrality" rule of construction (Section 6602) codifies the Trump administration's approach to AI ideology, preventing the government from directing vendors to alter models for viewpoint-based reasons
• The missile defense subscription prohibition (Section 1654) addresses concerns about defense contractors locking critical military capabilities behind subscription models

Unlike the Trump administration's AI Action Plan, which emphasized acceleration without brakes, the FY2026 NDAA calls for creation of several new internal processes, frameworks, and governance structures to identify, measure, and mitigate risks from advanced AI systems — reflecting a legislative preference for structured risk management alongside rapid AI adoption.

Source documents

• CRS — Cyber and AI Provisions in the FY2026 NDAA
• K&L Gates — AI Provisions in FY2026 NDAAs
• WilmerHale — What the NDAA Means for AI and Cybersecurity
• Brennan Center — The Good, Bad, and Really Weird AI Provisions in the NDAA
• Government Contracts Legal Forum — The FY2026 NDAA
• Akin Gump — Congress Moves Forward with AI Measures

Related articles

• NDAA AI Provisions
• NDAA FY2024 AI Provisions
• NDAA FY2025 AI Provisions
• Advancing American AI Act
• Executive Order 14319
• Legislation and Regulation

References