Defense AI Reliability and Reporting Act
- Sponsor
- Rep. Jacobs, Sara [D-CA-51]
- Committees
- Armed Services Committee (primary)
- Last action
- Aug 31, 2026
Bottom line
The Defense AI Reliability and Reporting Act establishes a critical framework within the Department of Defense to proactively identify and address risks associated with artificial intelligence systems, aiming to enhance their safety and operational integrity.
What it actually does
This bill directs the Secretary of Defense to establish a centralized, Department-wide program for reporting, tracking, analyzing, and remediating artificial intelligence (AI) incidents and vulnerabilities. The program aims to identify recurring risks, support mitigation efforts, and inform decisions to enhance the safety, security, reliability, and operational effectiveness of AI systems within the Department of Defense. It mandates non-punitive reporting, protection of sensitive information, and annual reports to Congress.
Proponents argue
Proponents argue that as the Department of Defense increasingly integrates AI into critical operations, a robust and centralized mechanism for identifying and addressing AI-related incidents and vulnerabilities is essential to prevent catastrophic failures, ensure system reliability, and maintain national security. They emphasize that learning from past incidents and fostering a culture of non-punitive reporting will lead to safer, more effective AI deployment.
Opponents contend
Opponents might express concerns about potential bureaucratic overhead, the risk of over-reporting minor issues that could stifle innovation, or the challenge of protecting sensitive information while ensuring broad dissemination of lessons learned. Some might also argue that existing safety and cybersecurity protocols are sufficient or that a new, dedicated AI-specific program could create redundant processes.
The bill is concise and clearly structured, making it accessible for a reader to understand its core provisions within a short timeframe.
Section 2, new section 2224b(a) of title 10, United States Code
Establishment of Centralized DoD AI Incident and Vulnerability Reporting Program
This provision mandates the Secretary of Defense to create a single, department-wide system for reporting, tracking, analyzing, and fixing problems (incidents) and weaknesses (vulnerabilities) that come up when AI systems are developed, tested, bought, used, or operated within the Department of Defense.
Supporters argue
Supporters argue this program is crucial for proactively managing the unique risks of AI in military applications, ensuring operational reliability and preventing potential harm.
Critics contend
Some might argue that establishing a new, centralized program could add unnecessary bureaucracy and potentially duplicate existing safety or cybersecurity reporting mechanisms within the DoD.
Tradeoffs
Balances the need for comprehensive AI risk management with potential administrative burden and integration challenges with existing DoD processes.
Section 2, new section 2224b(b) and (c) of title 10, United States Code
Purpose and Requirements for the AI Reporting Program
This section outlines the goals of the AI reporting program, which include identifying recurring risks, failure modes, and systemic weaknesses in AI systems (including human-machine teaming), supporting risk mitigation, and informing future decisions on AI testing, procurement, cybersecurity, and deployment. It also specifies that the program should be designed using best practices from established safety and vulnerability reporting programs, emphasize non-punitive reporting, protect sensitive information, and facilitate timely data sharing for analysis.
Section 2, new section 2224b(d), (e), and (f) of title 10, United States Code
Designation of Official, Incident Categorization, and Response Coordination
The Secretary of Defense must appoint an official to manage the program, who will receive, standardize, and analyze reports, identify trends, and issue guidance. This official will also categorize reported incidents and vulnerabilities based on whether they require a Department-wide, program-level, or local response. For Department-wide or program-level issues, the official coordinates appropriate responses like remediation or retesting, and for Department-wide issues, a documented corrective action plan and validation of mitigation measures are required.
Section 2, new section 2224b(g) and (h) of title 10, United States Code
Protection of Reporters and Information
This provision requires the Secretary to create a protected disclosure process, similar to vulnerability disclosure practices, allowing military personnel, civilian employees, contractors, and subcontractors to report AI incidents and vulnerabilities in good faith without fear of retaliation (adverse contract or personnel action). It also mandates procedures to protect sensitive, proprietary, and classified information submitted through this process.
Section 2, new section 2224b(i) of title 10, United States Code
Annual Reporting to Congress
From 2027 through 2031, the Secretary of Defense must submit an annual report to the congressional defense committees on the program. This report must include the number and categorization of reports, a summary of trends, risks, and corrective actions, and specific details for any AI incident resulting in loss of life or bodily harm to service members (including system involved, date, cause, consequence, and corrective actions). It also requires recommendations for changes to AI policies. Reports are unclassified but may include a classified annex.
Section 2, new section 2224b(j) of title 10, United States Code
Definitions for Artificial Intelligence, Covered AI Incident, and Covered AI Vulnerability
This section defines critical terms used throughout the new statute. "Artificial intelligence" refers to the definition in the National Artificial Intelligence Initiative Act of 2020. "Covered AI incident" is broadly defined to include events where an AI system causes unintended harm, operates outside parameters, degrades mission performance, fails to respond to disengage commands, or raises concerns about control. "Covered AI vulnerability" means an exploitable weakness that could affect mission performance, compromise integrity, create safety risk, or result in unauthorized behavior.
Defines "covered AI incident" broadly to include not only actual harm but also operation outside authorized parameters, degradation of mission performance, failure to respond to disengage commands, potential for significant harm, or operation raising concerns about system control and autonomy.
Section 2, new section 2224b(j) of title 10, United States Code
Why it matters:Standard legislative practice to place definitions at the end of a section. However, the breadth of this definition is key to the bill's impact.
Case for: Supporters would argue that a broad definition of "covered AI incident" is necessary to capture the full spectrum of potential risks and failures in complex AI systems, ensuring proactive identification and mitigation before severe consequences occur.
Case against: Critics might contend that such a broad definition could lead to an overwhelming number of reports, including minor or speculative issues, potentially diverting resources from more critical vulnerabilities and creating an administrative burden.
Estimated impact: Significantly expands the scope of reportable events beyond direct harm, encompassing a wide range of operational anomalies and control concerns, thereby increasing the data volume for the reporting program.