Insider threat risk assessment and voluntary guidance for certain artificial intelligence contractors

(a) Assessment and issuance of voluntary guidance on insider threat risk reduction (1) In general Not later than 180 days after the date of the enactment of this Act, the Secretary of Defense shall issue voluntary guidance for covered artificial intelligence contractors to reduce insider threat, espionage, and other personnel-related security risks to sensitive artificial intelligence systems and associated development infrastructure. (2) Assessment and updated guidance Not later than one year after the date of the enactment of this Act, the Secretary shall— (A) complete an assessment of the risks described in paragraph (1); and (B) update the guidance issued under such paragraph based on the findings of that assessment. (3) Contents The guidance required under paragraph (1), including any updated guidance issued under paragraph (2)(B), shall, at a minimum— (A) identify categories of roles, functions, models, training infrastructure, and systems that warrant enhanced security measures; (B) recommend a risk-based framework based on the sensitivity of access and associated national security risks; and (C) address personnel vetting, access controls, auditing, monitoring, anomaly detection, and protection against insider threats and espionage. (4) Rule of construction Nothing in this subsection shall be construed to require a covered artificial intelligence contractor to adopt any measure, practice, personnel policy, access restriction, or other safeguard described in the guidance issued under paragraph (1). (5) Consultation In carrying out this subsection, the Secretary may consult with covered artificial intelligence contractors, appropriate intelligence and counterintelligence officials, appropriate elements of the Department of Defense, and other relevant experts. (b) Report to Congress (1) In general Not later than July 1, 2028, the Secretary of Defense shall submit to the congressional defense committees an unclassified report, which may include a classified annex, on the implementation of this section. (2) Elements The report shall include— (A) a summary of the findings of the assessment conducted under subsection (a)(2)(A); (B) an assessment of gaps and challenges in mitigating the risks identified in such assessment; (C) a summary of the voluntary guidance issued under subsection (a), including the initial guidance and any updated guidance issued under subsection (a)(2)(B); and (D) any recommendation for additional authorities, resources, or policy the Secretary determines appropriate. (c) Definition The term covered artificial intelligence contractor means a contractor that develops, maintains, or operates artificial intelligence systems for the Department of Defense and has access to artificial intelligence systems, models, development infrastructure, or related technical information.