S 1071
National Defense Authorization Act for Fiscal Year 2026
TL;DR
Senator John Cornyn's National Defense Authorization Act (NDAA) for FY2026 is now law. While primarily a defense spending bill, NDAAs typically include AI provisions covering Pentagon AI adoption, contractor requirements, and restrictions on foreign AI systems (especially Chinese-developed models) in defense supply chains.
How This Might Impact Your Business
Defense contractors and subcontractors face new AI procurement standards, likely including requirements to disclose AI components in bids and prove models weren't trained on adversarial data sources.
Companies selling AI tools to the Department of Defense must comply with testing, evaluation, and cybersecurity certification requirements before contract awards.
Firms using AI models developed in China, Russia, Iran, or North Korea in any DoD-connected work face potential prohibitions or divestment requirements.
Cloud providers, chip manufacturers, and AI infrastructure companies serving defense clients should expect expanded reporting on foreign investment, workforce nationality, and supply chain origins.
Dual-use AI companies (commercial products also sold to military) may face export control implications tied to NDAA-authorized Commerce and Treasury actions.
Small and mid-size tech vendors pursuing DoD contracts through programs like SBIR should review new AI-specific solicitation language before responding.
Non-compliance risks include contract termination, debarment from federal contracting, and False Claims Act exposure rather than direct civil fines.
What Should You Do
Direct your government contracts team to pull the enacted text of Public Law 119-60 and flag every AI-related section, then map each provision to your current DoD-facing product lines.
Audit your AI supply chain for any foundation models, training datasets, or components sourced from restricted foreign entities and prepare divestment or replacement plans.
Update contract compliance checklists and rep-and-warranty language for any active or pending DoD, DHS, or intelligence community proposals.
Brief your CISO and CTO on new AI testing, evaluation, and cybersecurity certification expectations so product roadmaps align with defense procurement timelines.
If you sell commercial AI products, have export controls counsel assess whether NDAA-linked Commerce Department actions could reclassify your technology.
Who It Affects
Sponsors
Status Timeline
enacted
Became Public Law No: 119-60.
December 18, 2025