Insider Threat Reporting and Security Guidance Act of 2026

Regulatory or Legal Changes Top 1

AI Contractor Security Reporting and Incident Notification Requirements

Requires large Department of Defense (DoD) AI contractors to report security practices, insider threat policies, access controls, and incidents to the DoD — including disclosing vulnerabilities or breaches — when bidding on contracts, every 90 days thereafter, and within 72 hours of acute national security incidents.

• Population Scope Low Directly affects only large AI companies meeting both a $100M Department of Defense (DOD) contract threshold and $1B in AI R&D spending over three years — a narrow set of entities.
• Budgetary Magnitude Low No appropriation or funding authorization is provided; the bill imposes compliance obligations on contractors without allocating federal dollars.
• Legal / Regulatory Depth High Creates new statutory mandates — binding reporting duties, recertification obligations, and incident-notification requirements — that did not previously exist for this contractor class.
• Degree of Discretion Granted Medium The Secretary of Defense is directed by mandatory 'shall' language to issue regulations but retains meaningful discretion in defining the content, scope, and enforcement mechanics of those regulations.
• Implementation & Enforcement Burden High Imposes a recurring affirmative compliance obligation — bid-time disclosure, 90-day recertification, and 72-hour incident notification — requiring DoD to build and sustain ongoing monitoring and intake infrastructure.
• Temporal Commitment High Persists indefinitely until Congress acts to repeal or amend it.