Insider Threat Reporting and Security Guidance Act of 2026

monitoring systems, evaluation pipelines, or model-update mechanisms; (IX) the discovery of a material vulnerability, exploit, backdoor, or failure of access controls that could permit unauthorized modification, extraction, degradation, or misuse of any such model or model weights; or (X) any other effort; (iii) the defense-relevant and national security-relevant capabilities, access pathways, and material misuse risks, as determined by the Secretary, of the most powerful artificial intelligence models developed, controlled, or used by such contractor in the performance of a contract with the Department; (iv) any materially concerning model behavior, including materially increased capability for a cyber offense, evasion of safeguards, deceptive behavior, unauthorized autonomous action, or other behavior that could materially affect national security, the performance of a Department contract, or the operations, security, or mission effectiveness of the Department; (v) any attempt to obtain unauthorized access to, acquire, influence, or exfiltrate sensitive information, systems, or intellectual property relating to any artificial intelligence model developed, controlled, or used by the contractor; and (vi) any other known or suspected acute national security risk relating to the compromise, misuse, loss, exfiltration, misalignment, or exploitation of artificial intelligence models developed, controlled, or used by the contractor that could materially affect national security, the performance of a Department contract, or the operations, security, or mission effectiveness of the Department. (B) Scope.--The required matters described in subparagraph (A) apply to a covered artificial intelligence contractor, including with respect to any artificial intelligence model developed or controlled by another person and used, or proposed for use, by the covered artificial intelligence contractor in the performance of a contract with the Department. The Secretary may require the covered artificial intelligence contractor to obtain from the person who developed or controls such model any information the Secretary determines necessary to carry out this section. (C) Timing of reporting requirements.-- (i) Initial submission.--A covered artificial intelligence contractor shall submit to the Secretary of Defense the required matters described in subparagraph (A) as part of any offer, proposal, bid, or other response to a solicitation for a contract. (ii) Continuing duty to certify.--Not less frequently than once every 90 days, the covered artificial intelligence contractor shall certify to the Secretary of Defense that the information submitted under clause (i) remains accurate and complete in all material respects. (3) Notification of acute national security incidents.-- (A) In general.--The regulations issued pursuant to paragraph (1) shall require that not later than 72 hours after becoming aware of any information, incident, or development that presents an acute national security risk to the United States, the covered artificial intelligence contractor shall-- (i) notify the Secretary of Defense of the nature of national security risk, including any risk relating to model weight security as described in subparagraph (A)(ii), any risk described in clauses (iv), (v), and (vi) or subparagraph (A), and any other category of risk the Secretary may specify; and (ii) include in such notification, to the extent known at the time of the notification-- (I) a description of the information, incident, or development; (II) the date or approximate period of occurrence and discovery; (III) the affected model or deployment environment; (IV) the actual or suspected means of compromise; (V) whether any model weights, training data, system prompts, source code, evaluation data, safety systems, or software dependencies were accessed, altered, degraded, poisoned, exfiltrated, or otherwise compromised; (VI) an assessment of the actual or potential impact on Department of Defense missions, users, systems, operations, or decision making; (VII) any actions taken to contain, mitigate, remediate, or investigate the information, incident, or development; (VIII) whether the information, incident, or development has been reported to any other Federal department or agency; and (IX) such other information as the Secretary determines appropriate. (B) Notification by the secretary.--If the Secretary of Defense receives a notification under subparagraph (A), the Secretary shall promptly transmit such notification to the contracting officer for the relevant contract, the Chief Digital and Artificial Intelligence Office, the Chief Information Officer of the Department of Defense, the Under Secretary of Defense for Acquisition and Sustainment, the Artificial Intelligence Security Center of the National Security Agency, the Commander of the United States Cyber Command, and the head of any other component of the Department or Federal department or agency the Secretary determines appropriate. (C) Congressional notification.--If the Secretary of Defense receives a notification under subparagraph (A) or discovery an incident that would be reportable under such clause, the Secretary shall-- (i) not later than 7 days after the date on which the notification was received, submit to the Committee on Armed Services of the Senate and the Committee on Armed Services of the House of Representatives notice of the information, incident, or development that includes-- (I) a summary description; (II) the date or approximate period of occurrence and discovery; (III) the affected model or deployment environment; (IV) the actual or suspected means of compromise, exfiltration, manipulation, degradation, or misuse; (V) an initial assessment of actual or potential impact on Department missions, users, systems, or operations; and (VI) any action taken or planned to contain, mitigate, remediate, or investigate the matter; and (ii) provide the committees with additional briefings or updates on the information, incident, or development as material information becomes available. (D) Protection of information.--In the regulations issued under paragraph (1), the Secretary of Defense shall include procedures for the submission of notifications under this paragraph, including procedures to protect-- (i) classified information; (ii) proprietary information; (iii) trade secrets; (iv) security-sensitive information; and (v) information regarding vulnerabilities that, if disclosed publicly, could reasonably be expected to harm national security. (E) Rule of construction.--Nothing in this paragraph may be construed-- (i) to require public disclosure of information in a manner inconsistent with applicable protections for classified or otherwise protected information; or (ii) to limit any other reporting obligation imposed by statute, regulation, or contract. (4) Clarity of requirements.--In the regulations issued pursuant to paragraph (1), the Secretary shall provide clear requirements with respect to the scope, timing, form, and manner of the reporting, including-- (A) the appropriate protections the Department will take to prevent unauthorized disclosure of classified information, proprietary information, and controlled unclassified information; (B) any differentiated reporting requirements based on-- (i) the sensitivity of the contract; (ii) the capabilities of the relevant models; (iii) the degree of access of the contractor or third parties to artificial intelligence models or model weights; and (iv) the significance of the risk to Department missions or national security; and (C) procedures to ensure that, if a covered artificial intelligence contractor uses, or proposes to use, in the performance of a contract with the Department an artificial intelligence model developed or controlled by another person, any information required under this section is obtained from that person. (5) Consultation.--In developing the regulations under paragraph (1), the Secretary may consult with-- (A) covered artificial intelligence contractors; (B) the head of any Federal agency; (C) industry participants; and (D) any official of the Department that the Secretary considers relevant, including acquisition, counterintelligence, digital modernization, and operational officials of the Department. (c) Study and Voluntary Guidance on Insider Threat Risk Reduction for Covered Artificial Intelligence Contractors.-- (1) In general.--Not later than 180 days after the date of the enactment of this Act, the Secretary of Defense shall issue voluntary guidance for covered artificial intelligence contractors to reduce insider threat, espionage, and other personnel-related security risks to sensitive artificial intelligence assets of such contractors, with a focus on threats from highly capable nation-state adversaries that possess significant resources and the capability to conduct sophisticated espionage or related operations. (2) Assessment and updated guidance.--Not later than 1 year after the date of the enactment of this Act, the Secretary shall-- (A) complete an assessment of the risks described in paragraph (1); and (B) updated the guidance issued under such paragraph based on the findings of that assessment. (3) Contents.--The guidance required under paragraph (1), including any updated guidance issued under paragraph (2)(B), shall, at a minimum-- (A) identify categories of roles, responsibilities, functions, systems, and access that may provide material access to model weights, model internals, training infrastructure, sensitive research information, or other sensitive assets of the covered artificial intelligence contractor, the compromise of which could present a significant risk to Department missions or national security; (B) establish a tiered framework based on the degree of access, sensitivity, and national security risk involved, under which the most sensitive roles, systems, and categories of access are associated with the most stringent suggested security measures; (C) assess the practices, and if appropriate suggest preferred practices, relating to personnel vetting, role-based access controls, compartmentation, audit logging, anomaly detection, continuous monitoring, incident escalation, and protection against espionage, theft, sabotage, or unauthorized transfer, including practices designed to address threats from nation-state adversaries; (D) address, for especially sensitive roles or access, what personnel security measures, access restrictions, or other safeguards are appropriate to reduce heightened risks from nation-state adversaries; and (E) address such other measures as the Secretary determines appropriate to protect Department missions and national security from insider threat and espionage risks arising from the security practices of covered artificial intelligence contractors. (4) Rule of construction.--Nothing in this subsection shall be construed to require a covered artificial intelligence contractor to adopt any measure, practice, personnel policy, access restriction, or other safeguard described in the guidance issued under paragraph (1). (5) Consultation.--In carrying out this subsection, the Secretary may consult with covered artificial intelligence contractors, the intelligence community, counterintelligence officials, appropriate elements of the Department of Defense, the heads of other Federal agencies, federally funded research and development centers, and other relevant experts, as determined appropriate by the Secretary. (d) Report to Congress.-- (1) In general.--Not later than 1 year after the date of the enactment of this Act, the Secretary of Defense shall submit to the congressional defense committees an unclassified report, which may include a classified annex, on the implementation of this section. (2) Elements.--The report required by paragraph (1) shall include-- (A) a summary of the progress made in developing and implementing the reporting requirements under subsection (b)(1); (B) a summary of the progress made in issuing the voluntary guidance under paragraph (1) of subsection (c), including the initial guidance and any updated guidance issued under paragraph (2) of such subsection; (C) an assessment of any challenges, gaps, or limitations identified by the Secretary in carrying out this section; and (D) any additional steps, authorities, resources, or policy recommendations the Secretary determines would be useful to advance the purposes of this section. (3) Congressional defense committees defined.--The term ``congressional defense committees'' has the meaning given the term in section 101 of title 10, United States Code. <all>