PRIA Logo™
119-s-5601119th Congress

Insider Threat Reporting and Security Guidance Act of 2026

Sponsored By: Senator Banks, Jim [R-IN]

Introduced

Summary

Insider threat reporting by large Department of Defense AI contractors would be standardized to protect DoD systems, missions, personnel, and supply chains. The bill would direct the Secretary of Defense to write rules within 180 days, require rapid notification of acute incidents, and publish voluntary insider-threat guidance plus a one-year implementation report to Congress.

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

3 provisions identified: 1 benefits, 0 costs, 2 mixed.

Voluntary AI security guidance for contractors

If enacted, the Defense Department would issue voluntary guidance within 180 days to help covered AI contractors reduce insider‑threat and espionage risks. The guidance would identify sensitive roles and access, offer a tiered framework linking sensitivity to suggested security measures, and recommend vetting, access controls, monitoring, logging, anomaly detection, and incident escalation practices. The Secretary would complete a risk assessment and update the guidance within one year. The guidance would be nonbinding, so contractors would not be required to adopt the recommendations.

New reporting rules for AI contractors

If enacted, the Defense Department would issue rules within 180 days that require covered AI contractors to report security policies, controls, and incidents. Contractors would have to include required information with offers or bids and certify every 90 days that it remains materially accurate. They would have to notify the Secretary within 72 hours of any acute national-security incident and provide specified details about the incident and its impact. The rules would cover third‑party models, allow the Secretary to require information from model developers, and include procedures to protect classified and proprietary information.

Which contractors must report

If enacted, the bill would define a covered AI contractor as a firm with DoD AI contracts totaling at least $100,000,000 that also either spent at least $1,000,000,000 on AI R&D in the prior 3 years (rolling, including affiliates) or uses a model developed or controlled by someone who meets that $1 billion R&D test. That definition would determine which contractors must follow the proposed reporting and guidance rules.

Sponsors & CoSponsors

Sponsor

Banks, Jim [R-IN]

IN • R

Cosponsors

  • Sen. Gillibrand, Kirsten E. [D-NY]

    NY • D

    Sponsored 9/29/2026

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov
Back to Legislation