A bipartisan bill introduced by Senators Jim Banks and Kirsten Gillibrand would direct the Pentagon to establish ongoing reporting requirements and voluntary guidance for certain large commercial frontier AI contractors, according to an October 8 DefenseScoop report.

The aim is to help protect Defense Department systems, missions, personnel, operations, and supply chains from counterintelligence, security, and other national security risks associated with contractors’ security practices.

Covered companies would need to provide information about: 

• their model-security policies, practices, and safeguards
• who has access to model weights and training
• suspected incidents affecting the security, integrity, or availability of the technology
• unauthorized access, exfiltration, or sabotage involving data or models
• past safeguard evasions, unprompted autonomous actions, and other concerning AI behavior

The proposed Insider Threat Reporting and Security Guidance Act of 2026 would require the secretary of defense to issue regulations within 180 days establishing reporting requirements for covered AI contractors.

“Right now, the Pentagon is moving toward deploying incredibly powerful AI technology without commonsense guardrails in place, which could have catastrophic consequences for our national security,” Gillibrand told DefenseScoop in an email.

Proposed Rules Would Create Ongoing Reporting

The proposed bill would apply to companies meeting specified criteria, including contractors with AI agreements worth $100 million or more with the Department of Defense (DOD), among other caveats. Covered contractors would have to certify at least every 90 days that the information they provide remains accurate and complete, according to the report.

The legislation would also establish deadlines for reporting certain problems: 

• National security incidents, such as theft of model weights, would have to be reported within 72 hours of discovery 
• Material vulnerabilities in a model, as well as concerning conduct, would have to be reported within 7 days of discovering that the issue is material

AI Vendor Data Becomes a Governance Issue

For chief data officers (CDOs), the proposal is an excellent example of how organizations may govern external AI systems. 

Vendor oversight could extend beyond contractual assurances to maintaining current information about model access, training, security events, and observed behavior.

That creates a data-governance requirement of its own. Organizations deploying advanced AI need reliable records of which models are in use, who can access them, what controls apply, and whether vendor-provided information remains current.

The Pentagon proposal also puts pressure on AI vendors to provide information that can support ongoing risk assessments rather than one-time procurement reviews. That aligns with the broader move toward AI governance as a continuous operational process.