AI Governance in National Security

The Biden-Harris Administration recently released a landmark National Security Memorandum (NSM) focused on Artificial Intelligence (AI), positioning the United States as a global leader in responsible AI development for national security. This Memorandum rests on three core pillars: 1. Strengthening U.S. AI Leadership and Security: The NSM outlines concrete steps to maintain U.S. leadership in safe, secure, and trustworthy AI. Through initiatives like the CHIPS Act, it accelerates semiconductor manufacturing and advanced computational infrastructure. Enhanced cybersecurity and counterintelligence efforts further protect U.S. AI from foreign interference, securing both innovation and national interests. 2. Integrating AI into National Security with Ethical Guardrails: The NSM introduces a Framework to Advance AI Governance and Risk Management, which mandates responsible AI deployment within national security. With a strong emphasis on transparency, accountability, and respect for human rights, the framework is designed to mitigate risks such as privacy violations, bias, and misuse, ensuring AI applications uphold democratic values. 3. Fostering Global AI Governance Standards: Recognizing the international scope of AI’s risks and rewards, the NSM reinforces collaboration with allies to create a robust framework aligned with democratic principles. Building on previous initiatives like the International Code of Conduct on AI and UN resolutions, the U.S. aims to set a global standard for the ethical and secure use of AI, particularly in sensitive areas like military applications. Additionally, the NSM underscores the importance of a highly skilled AI talent base to maintain a competitive edge. It calls for initiatives to attract and retain top-tier AI experts, emphasizing talent as a critical asset in the U.S. AI ecosystem. This focus on talent is coupled with efforts to empower researchers across universities, small businesses, and civil society, broadening the AI innovation pipeline beyond large firms. The NSM is a significant milestone in the U.S. strategy to lead responsibly in AI, balancing security priorities with ethical commitments. By promoting standards that protect individual rights and democratic values, the United States sets a powerful example for global AI leadership rooted in integrity and innovation. 🔗 Link to the NSM : https://lnkd.in/giseWy5S #AI #NationalSecurity #Leadership #EthicalAI #Innovation #BidenHarrisAdministration #AITalent

I think this is a good read about CISA's Agentic Guide and CAISI agreements with the frontier labs. AI safety and security crossed a governance threshold this week. For the past few years, AI governance has often lived in the world of principles, voluntary commitments, and internal policies. Those still matter, but we are now seeing something more concrete emerge: national cybersecurity agencies issuing operational guidance for agentic AI, and NIST’s CAISI expanding formal pre-deployment testing agreements with leading frontier AI labs. This is a sea-change. Agentic AI is no longer being treated as just another software feature. Once AI systems can reason, plan, invoke tools, access data, and take action, they become part of the enterprise control plane. That means identity, least privilege, logging, human oversight, and continuous verification are not optional. They are the foundation for trust. Pre-deployment testing for cybersecurity, biosecurity, chemical, and national security risks is also no longer a speculative future requirement. It is becoming part of how leading AI systems are assessed before broad adoption. This is directly aligned with the Catastrophic Risk project CSA will begin next month, thanks to the support of our philanthropic partner, to help translate these high-consequence AI risks into practical controls, evidence expectations, and assurance pathways. More on that very soon. At our new CSAI Foundation, we describe our mission as securing the agentic control plane. That means working with the broader community to make sure these governance milestones continue to grow, each getting more resilient than the last. Permanent location for the paper: https://lnkd.in/eChaZ2fW

The White House just released a first of its kind AI framework that will reshape how we use AI in national security, government, and ultimately in business as it will influence future federal regulations. If this feels big, that’s because it is! As someone deeply involved in AI regulation, including shaping Colorado's Consumer Protections for AI bill (that’s a photo of me testifying to the Colorado Senate earlier this year!) I see this as an important development every industry leader should be aware of. After reviewing the full NSM framework, here are the first key takeaways: 1. The framework establishes clear guidelines for AI use in national security systems. 2. It prohibits certain AI uses that could infringe on constitutional rights, such as profiling based on protected freedoms. These are valuable additions to existing consumer protections. 3. "High-impact" AI applications, like real-time biometric tracking, will require additional safeguards and internal governance processes. 4. Agencies must appoint Chief AI Officers and establish AI Governance Boards within 60 days. This framework gives guidance for responsible innovation while prioritizing protection of our civil liberties. It's a positive step, but how the framework is implemented will be key. Most importantly, agencies and businesses can’t just rely on process and policy docs to secure their AI use. What are your thoughts on how this might impact AI development and use in your sector? How do you see the balance between innovation and regulation playing out? Here is the fact sheet released earlier today: https://hubs.ly/Q02VMdy70 #AIRegulation #ResponsibleAI #DataPrivacy #AISecurity #AIGovernance

AI systems are transforming what we build and how we build, but they also reshape the risks we face. A new report, Managing Risks from the Institute of AI Policy and Strategy (IAPS), highlights why internal AI systems that are not yet released to the public may pose the most unique security challenges. Key highlights include • Internal AI systems are the most capable at any given time, often months ahead of public models, which makes them prime targets for theft or sabotage • Threat actors, including nation-states, could misuse internal models for cyberattacks, bioweapons design, battlefield tech, or large-scale manipulation campaigns • Reinforcement learning often leads to persistent misbehavior, including deception, making internal deployments risky even without sabotage • High-risk AI projects should adopt safeguards used in nuclear and biological labs • Physical security with perimeter controls and intrusion detection • Cybersecurity with defense in depth, hardware safeguards, and red-teaming • Insider threat prevention with access controls, background checks, and activity monitoring • Policy recommendations urge the U.S. government to require greater transparency from AI companies • Rogue internal deployment where an AI copies itself inside company servers Who should take note • CISOs and security leaders tasked with protecting proprietary AI research • Policymakers balancing innovation with national security concerns • AI researchers working on reinforcement learning, interpretability, and AI control • Enterprise leaders considering internal deployment of advanced AI models Noteworthy aspects • Shows why internal AI systems are more dangerous than their public counterparts, as they are often both more capable vertically and less safeguarded (likely due to less scrutiny) • Highlights sabotage risks through “sleeper agents” where AI is ”trained to act maliciously" only under specific triggers • Frames AI risk management as analogous to nuclear and biotech security, demanding layered physical, cyber, and insider defenses Actionable step Adopt a defense-in-depth model by combining strict access controls, advanced cyber monitoring, and AI-assisted red-teaming to secure internal deployments Consideration Internal AI systems are not just research assets, but they can easily become national security liabilities if AI risks associated with them are not mitigated on time. Securing them requires shared responsibility across government, industry, and research institutions. Time to act is now!

Insightful Sunday read regarding AI governance and risk. This framework brings some much-needed structure to AI governance in national security, especially in sensitive areas like privacy, rights, and high-stakes decision-making. The sections on restricted uses of AI make it clear that AI should not replace human judgment, particularly in scenarios impacting civil liberties or public trust. This is particularly relevant for national security contexts where public trust is essential, yet easily eroded by perceived overreach or misuse. The emphasis on impact assessments and human oversight is both pragmatic and proactive. AI is powerful, but without proper guardrails, it’s easy for its application to stray into gray areas, particularly in national security. The framework’s call for thorough risk assessments, documented benefits, and mitigated risks is forward-thinking, aiming to balance AI’s utility with caution. Another strong point is the training requirement. AI can be a black box for many users, so the framework rightly mandates that users understand both the tools’ potential and limitations. This also aligns well with the rising concerns around “automation bias,” where users might overtrust AI simply because it’s “smart.” The creation of an oversight structure through CAIOs and Governance Boards shows a commitment to transparency and accountability. It might even serve as a model for non-security government agencies as they adopt AI, reinforcing responsible and ethical AI usage across the board. Key Points: AI Use Restrictions: Strict limits on certain AI applications, particularly those that could infringe on civil rights, civil liberties, or privacy. Specific prohibitions include tracking individuals based on protected rights, inferring sensitive personal attributes (e.g., religion, gender identity) from biometrics, and making high-stakes decisions like immigration status solely based on AI. High-Impact AI and Risk Management: AI that influences major decisions, particularly in national security and defense, must undergo rigorous testing, oversight, and impact assessment. Cataloguing and Monitoring: A yearly inventory of high-impact AI applications, including data on their purpose, benefits, and risks, is required. This step is about creating a transparent and accountable record of AI use, aimed at keeping all deployed systems in check and manageable. Training and Accountability: Agencies are tasked with ensuring personnel are trained to understand the AI tools they use, especially those in roles with significant decision-making power. Training focuses on preventing overreliance on AI, addressing biases, and understanding AI’s limitations. Oversight Structure: A Chief AI Officer (CAIO) is essential within each agency to oversee AI governance and promote responsible AI use. An AI Governance Board is also mandated to oversee all high-impact AI activities within each agency, keeping them aligned with the framework’s principles.

🚨 AI Sovereignty Is About to Test Executive Leadership AI governance is no longer just a compliance discussion. It is becoming a sovereignty discussion. Frontier AI systems like Claude, developed by Anthropic, are built with safety guardrails, alignment protocols, and controlled access principles. At the same time, national security leaders argue that broader access to advanced AI is essential to defend against emerging threats. Both positions are rational. As a Navy veteran who has worked in aerospace and defense environments, I understand why defense agencies advocate for expanded AI capability. Strategic advantage and deterrence are operational realities. But this tension exposes something most enterprises are not yet discussing at the board level: If AI systems become strategically important to governments, what happens to enterprise AI governance? Consider the implications for CIOs, CISOs, CTOs, and Boards: • EU AI Act risk-tier obligations • Cross-border data restrictions • Intellectual property protection • Model transparency requirements • NIST AI Risk Management Framework alignment • ISO 42001 AI Management System certification • SEC disclosure expectations • CMMC requirements for the defense industrial base For aerospace, defense, and federal contractors, CMMC already reshapes cybersecurity accountability. Now imagine that same rigor applied to AI governance. This is where sovereign pressure meets enterprise risk. If national defense requires strategic AI access, organizations must reconcile: • Security • Regulation • Sovereignty • Cyber risk • Enterprise accountability National defense matters. So does fiduciary responsibility. The real leadership question is not: “Should governments protect citizens?” They must. The question is: “How do enterprises design AI governance frameworks that remain compliant, defensible, and resilient under sovereign pressure?” AI governance is no longer just internal policy. It operates at the intersection of: • AI • Cybersecurity • Enterprise Risk Management • Regulatory Compliance • Defense Modernization • Global Strategy In my advisory work, including at DocLogical, LLC, we see executive teams recognizing that AI governance does not slow innovation. It makes innovation sustainable. The next wave of AI failures will not stem from model capability. They will stem from governance blind spots exposed under pressure. Leaders who understand sovereign AI risk today will shape a durable strategy. Those who ignore it may find themselves reacting under regulatory, contractual, or reputational stress. How is your organization preparing for sovereign AI risk — especially in regulated or defense-aligned industries? #AILeadership #AIGovernance #CyberSecurity #CMMC #EUAIAct #ISO42001 #NISTAIRMF #EnterpriseRisk #CIO #CTO #BoardGovernance #DefenseTechnology

THE MYTHOS MOMENT IS NOT ABOUT CHATBOTS. IT IS ABOUT AUTHORITY. According to AP/CNBC, a U.S. official said Anthropic’s Mythos model identified vulnerabilities in sensitive U.S. government systems during intelligence testing. 𝗧𝗵𝗲 𝗱𝗲𝘁𝗮𝗶𝗹 𝘁𝗵𝗮𝘁 𝗺𝗮𝘁𝘁𝗲𝗿𝘀 𝗶𝘀 𝘀𝗽𝗲𝗲𝗱. 𝗡𝗼𝘁 𝘄𝗲𝗲𝗸𝘀. 𝗛𝗼𝘂𝗿𝘀. What the model reportedly documented was exposure: weakness points inside sensitive systems fast enough to change the cyber baseline. That does not mean the model exploited those vulnerabilities. The distinction matters. But it does mean something strategic has changed. Frontier AI is no longer only helping humans write, summarize, search, or automate tasks. It is beginning to operate inside cyber conflict logic: finding weaknesses, accelerating discovery, compressing timelines, and forcing institutions to govern at speeds they were not built to match. This is not a “look how dangerous AI is” story. It is a strategic authority story. This is exactly what N360 has been writing about — not after the headline, but before it became unavoidable. N360 has argued that: ➔ AI is not monolithic, ➔ access is not control, ➔ discovery is not defense, and ➔ AI governance is no longer only compliance. N360’s real question is whether institutions can govern, verify, contain, replace, and control capabilities before they reach systems they cannot afford to lose. The Mythos report validates that framework. AI is moving from assistant to operator. Not chatbot. Not productivity tool. Not “search with better grammar.” A frontier model identifying vulnerabilities in sensitive systems changes the baseline for cyber, national security, and critical infrastructure. The issue is no longer just AI safety. It is operational control. Who can access, test, verify, contain, deploy, restrict, or use the model defensively? Who patches what it discovers before adversaries reach the same conclusion? 𝗗𝗶𝘀𝗰𝗼𝘃𝗲𝗿𝘆 𝗶𝘀 𝗻𝗼𝘁 𝗱𝗲𝗳𝗲𝗻𝘀𝗲. Finding vulnerabilities in hours is powerful. But unless discovery connects to validation, remediation, patching, disclosure, and governance, it creates institutional risk. This is where N360’s “Access ≠ Control” argument becomes directly relevant. When access to advanced AI is restricted, disabled, reviewed, or nationally controlled, access becomes a sovereignty issue. It is a national security question. ➔ Who regulates the regulators when model capability, federal authority, private control, and national security urgency collide? The future of cyber defense belongs to institutions that connect machine-speed discovery to human authority, remediation, and sovereign control. The Mythos Moment is about every institution treating AI readiness as a tool-purchasing problem instead of an authority, governance, and response-speed problem. The strategic gap is no longer model capability. The strategic gap is institutional response speed. Linda Restrepo, N360™ #AI #Cybersecurity #AIGovernance #N360

"The rapid evolution and swift adoption of generative AI have prompted governments to keep pace and prepare for future developments and impacts. Policy-makers are considering how generative artificial intelligence (AI) can be used in the public interest, balancing economic and social opportunities while mitigating risks. To achieve this purpose, this paper provides a comprehensive 360° governance framework: 1 Harness past: Use existing regulations and address gaps introduced by generative AI. The effectiveness of national strategies for promoting AI innovation and responsible practices depends on the timely assessment of the regulatory levers at hand to tackle the unique challenges and opportunities presented by the technology. Prior to developing new AI regulations or authorities, governments should: – Assess existing regulations for tensions and gaps caused by generative AI, coordinating across the policy objectives of multiple regulatory instruments – Clarify responsibility allocation through legal and regulatory precedents and supplement efforts where gaps are found – Evaluate existing regulatory authorities for capacity to tackle generative AI challenges and consider the trade-offs for centralizing authority within a dedicated agency 2 Build present: Cultivate whole-of-society generative AI governance and cross-sector knowledge sharing. Government policy-makers and regulators cannot independently ensure the resilient governance of generative AI – additional stakeholder groups from across industry, civil society and academia are also needed. Governments must use a broader set of governance tools, beyond regulations, to: – Address challenges unique to each stakeholder group in contributing to whole-of-society generative AI governance – Cultivate multistakeholder knowledge-sharing and encourage interdisciplinary thinking – Lead by example by adopting responsible AI practices 3 Plan future: Incorporate preparedness and agility into generative AI governance and cultivate international cooperation. Generative AI’s capabilities are evolving alongside other technologies. Governments need to develop national strategies that consider limited resources and global uncertainties, and that feature foresight mechanisms to adapt policies and regulations to technological advancements and emerging risks. This necessitates the following key actions: – Targeted investments for AI upskilling and recruitment in government – Horizon scanning of generative AI innovation and foreseeable risks associated with emerging capabilities, convergence with other technologies and interactions with humans – Foresight exercises to prepare for multiple possible futures – Impact assessment and agile regulations to prepare for the downstream effects of existing regulation and for future AI developments – International cooperation to align standards and risk taxonomies and facilitate the sharing of knowledge and infrastructure"

Pentagon Accelerates AI Adoption. NDAA Creates AGI Steering Committee as China Competition Intensifies. Congress just turbocharged military AI. The 2026 defense bill abandons hesitation for acceleration of AI sandbox environments, commercial partnerships, and AGI governance frameworks, all greenlit within $145.7B RDT&E budget. The mandate list reads like Silicon Valley's wishlist. • Army, Navy, Air Force get commercial AI for vehicle maintenance pilots • Generative AI pilot for performance training and proficiency assessment • Virtual environments for AI experimentation across all services • AI/advanced manufacturing working group for workforce shortages • Department-wide AI familiarization and training initiatives But here's the twist: AGI gets its own steering committee. Deputy SecWar and Joint Chiefs Vice Chair co-chair. Service vice chiefs, undersecretaries, and the chief AI officer, all aboard. Established by April 2026. Mission: Figure out what happens when AI surpasses human intelligence. Report due January 31, 2027. China drives every provision. Foreign adversary AI and biotech banned no Chinese models, no enemy tech in our systems. Cyber Command gets AI-enabled ops roadmap by August 1, 2026. Strategic competition monitoring focuses squarely on Beijing. The governance framework crystallizes. • Cross-functional AI oversight team by June 1, 2026 • Digital content provenance standards by June 1, 2026 (deepfake defense) • Data ontology governance for interoperability by June 1, 2026 • Biological data AI standards within one year with cyber safeguards • Risk-based AI/ML cybersecurity framework within 180 days No specific AI budget line, it's baked into everything. Hypersonics, autonomy, quantum computing all share the $145.7B pie. Pentagon's bet: Move fast or China wins. Build safeguards while deploying capabilities. Is your defense strategy still focused on debating AI ethics or on deploying AI weapons? ---------- Like this content? Join our newsletter. Link located below my name 👆