Defense AI Insider Threat Rules

Summary#

The Insider Threat Reporting and Security Guidance Act of 2026 would create a new law; it does not amend an existing Act. It would require the Secretary of Defense to set reporting rules for certain large artificial intelligence (AI) contractors and issue voluntary security guidance. The stated goal is to protect Defense Department systems, missions, people, operations, and supply chains from security and national security risks.

  • The rules would cover contractors with Defense Department AI contracts worth at least $100 million, or seeking such contracts, if they or an associated model developer meet a $1 billion AI research and development spending test.
  • Covered contractors would have to report specified security practices and risks as part of each contract offer, bid, or other response to a solicitation, then certify at least every 90 days that the information remains materially accurate and complete.
  • Regulations must require covered contractors to notify the Secretary within 72 hours after learning of information, an incident, or a development that presents an acute national security risk.
  • The Secretary must pass those notifications to specified Defense Department and security officials, notify congressional armed services committees within seven days, and provide updates as material information becomes available.
  • The Secretary must issue voluntary insider-threat guidance within 180 days, assess the risks and update the guidance within a year, and report to Congress within a year. Contractors would not have to adopt the guidance.

What it means for you#

  • Covered AI contractors: If you meet the bill’s contract and spending or model-use tests, regulations would require you to report on personnel vetting, insider-threat measures, access controls, supply-chain security, and protection against theft or tampering. You would also report specified incidents, model risks and behavior, and attempts to obtain sensitive information.
  • Contractors using another person’s AI model: The reporting rules would also apply to that model. The Secretary may require you to obtain needed information from its developer or controller; the regulations must include procedures for obtaining it.
  • Covered contractors facing an acute national security risk: You would have to notify the Secretary within 72 hours of becoming aware of the relevant information, incident, or development. The bill requires rules to protect classified, proprietary, trade-secret, and other sensitive information.
  • Defense Department: The Secretary must issue regulations and guidance, assess risks, and report to Congress. The guidance is voluntary for contractors; the reporting requirements are not.
  • General public: The bill does not create a public reporting system or require public release of protected information.
  • Status: This is an introduced bill, read twice and referred to the Senate Armed Services Committee. It is not law, and passage is uncertain.

Money#

No cost information is in the available material.

  • The bill requires the Defense Secretary to develop regulations and guidance, conduct an assessment, and report to Congress, but provides no cost estimate or specific funding.
  • Covered contractors may have reporting and compliance costs; the bill gives no estimate.
  • The bill does not set a fee, fine, or payment to contractors.

What is unclear#

  • The bill leaves terms such as “acute national security risk,” “materially concerning model behavior,” and “most powerful” models for regulations or later interpretation.
  • The regulations will set the exact reporting form, scope, and timing, and may vary requirements by contract, model, access, and risk.
  • The bill does not specify a penalty or other enforcement process for failing to report, or an appeal process.
  • The bill does not explain how the new reporting rules would interact with existing reporting duties. The supplied material does not establish what those existing duties are: No publicly available information.
  • The bill does not give an effective date beyond deadlines tied to enactment.

Case for#

  • The bill appears intended to give the Defense Department regular information about contractor security practices and significant risks to AI models used in Defense work.
  • A 72-hour notice rule could help the Department learn about acute risks quickly, while the bill also requires notice to relevant officials and Congress.
  • The bill requires protections for sensitive information and allows reporting requirements to differ based on the contract and level of risk.
  • Voluntary guidance could offer contractors risk-reduction practices without requiring them to adopt every suggested measure.

Case against#

  • The reporting scope is broad, including security practices, model behavior, vulnerabilities, and attempts to access sensitive information. The bill does not yet say exactly what information will be required or how it will be protected in practice.
  • Contractors may need information from model developers or other third parties. The bill allows the Secretary to require contractors to obtain information, but the details of that process are left to regulations.
  • The bill creates reporting and government work without specifying funding or estimating costs.
  • The bill does not spell out penalties or an enforcement process, leaving the consequences of noncompliance unclear.