Cybersecurity Policy Report, Annual Defense Bill Would Require DoD to Establish AI Vulnerability Disclosure Program, (May 27, 2026)
The Department of Defense would have to establish a “centralized Department-wide program” to find and fix AI (artificial intelligence) systems that endanger DoD’s cyber defenses or otherwise pose a threat, according to provisions of the fiscal year 2027 National Defense Authorization Act (NDAA).
The program would have to identify “recurring risks, failure modes, vulnerabilities, and systemic weaknesses” in AI systems and “inform testing, procurement, cybersecurity, and deployment decisions to improve the safety, security, reliability, and operational effectiveness of such systems,” the bill says.
The program would have to include a “protected disclosure process, informed by established vulnerability disclosure practices, through which members of the Armed Forces, civilian employees, contractors, and subcontractors at any tier may report covered AI incidents and covered AI vulnerabilities in good faith,” it says.
The AI vulnerability disclosure requirements were included in the NDAA by the House Armed Services Committee’s cyber, information technologies, and innovation subcommittee. The subcommittee’s portion of the NDAA was released yesterday by the full committee, which plans to mark up the annual defense bill (H.R. 8800, 119th Cong. (2026)) on June 4 at 10 a.m. in Room 2118 of the Rayburn House Office Building.
The cyber subcommittee’s portion of the NDAA also would require DoD to establish an “Artificial Intelligence Model Rapid Deployment Framework.” The framework would have to “enable the evaluation, authorization, and deployment” of new AI systems “within 30 days after public availability,” the bill says.
To enable rapid deployment, the bill would call for “standardized processes for deploying AI systems onto Department enterprise AI platforms, including security reviews, technical assessments, and integration with other Department systems and platforms.”
As part of the rapid deployment framework, DoD would have to conduct “adversarial testing, supply chain risk assessments, and other security testing appropriate for AI systems, consistent with existing cybersecurity and test and evaluation policies,” according to the bill.
MainStory: TopStory FederalLegislation DataSecurity AINews