Bill > S5601

This bill, titled the "Insider Threat Reporting and Security Guidance Act of 2026," requires the Secretary of Defense to establish strict reporting rules and voluntary security guidelines for large artificial intelligence (AI) contractors that work with the Department of Defense (DoD). Specifically, it targets major companies—defined as those holding DoD contracts worth at least $100 million and having spent at least $1$ billion on AI research and development over a rolling three-year period, or those utilizing models built by such heavy spenders. Under the legislation, these contractors must regularly report their security practices, access controls, supply chain safeguards, and details on any high-risk AI capabilities or concerning behaviors to the DoD. Additionally, contractors are required to notify the Secretary of Defense within 72 hours of discovering acute national security risks, such as data breaches, espionage, or unauthorized modifications to sensitive AI assets like "model weights" (the core numerical parameters that determine an AI system's behavior). The Secretary of Defense must then share these urgent warnings with relevant military and intelligence offices, as well as notify the House and Senate Armed Services Committees within seven days while protecting sensitive trade secrets and classified information. Finally, the bill directs the DoD to issue and periodically update voluntary security guidance to help these contractors mitigate insider threats and foreign espionage, concluding with a requirement for the Secretary of Defense to submit an implementation report to Congress within one year.