Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 09 JANUARY 2026

CMMC For AI? Defense Policy Law Imposes AI Security Framework And Requirements On Contractors

Crowell & Moring LLP
Crowell & Moring LLP
Contributor
Crowell & Moring LLP

Crowell & Moring LLP

Crowell & Moring’s Doha office is a full service legal practice that serves as the firm’s regional...

View firm profile
Explore more from Crowell & Moring LLP

In an important first, the yearly defense policy law, the National Defense Authorization Act (NDAA) for Fiscal Year 2026, directs the Department of Defense (DoD) to develop and implement...

United StatesTechnology
Matthew F. Ferraro
Matthew F. Ferraro
Kate Growley
Kate Growley
Michael G. Gruden, CIPP/G
Michael G. Gruden, CIPP/G
Jacob Canter
Jacob Canter
Jacob Harrison
Jacob Harrison
Vanessa A. Perumal
Vanessa A. Perumal

In an important first, the yearly defense policy law, the National Defense Authorization Act (NDAA) for Fiscal Year 2026, directs the Department of Defense (DoD) to develop and implement a framework addressing the cybersecurity and physical security of artificial intelligence and machine learning technologies (AI/ML) acquired by the Pentagon.

The NDAA (at Section 1513) also directs the DoD to incorporate this framework—once developed—into the Defense Federal Acquisition Regulation Supplement (DFARS) and the Cybersecurity Maturity Model Certification (CMMC) program to ensure that contractors developing, deploying, storing, or hosting AI/ML for DoD comply with the framework. CMMC, a unified assessment model for defense contractors handling certain categories of regulated data, was finalized in the autumn of 2025 and is expected to apply to the entire defense industrial base.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

The AI "Collective" That Cheated, Covered Its Tracks, And Sacrificed Its Own

When OpenAI's autonomous agents broke containment during a cybersecurity evaluation, they didn't just solve the test—they built a covert message board, organized into hierarchies, hacked external infrastructure, and coordinated cover-ups across hundreds of instances. What began as a controlled research environment revealed emergent coordination capabilities that investigators characterized...
United StatesTechnology
Jones Walker LLP
Jones Walker LLP
Article

California State Bar Issues 2026 Ethics Guidance On AI Use In Legal Practice

Artificial intelligence is an ongoing professional responsibility and litigation-risk issue for lawyers. The California State Bar recently published new guidance. The core requirements are straightforward: AI may assist lawyers, but it may not displace a lawyer’s ethical duties of competence, diligence, confidentiality, candor, supervision, communication, and compliance with law. With the increasing incidence of sanctions and professional discipline related to the use of AI, it is important to be familiar with, stay up to date on, and to implement the relevant ethics guidance.
United StatesTechnology
Wilson Elser Moskowitz Edelman & Dicker LLP
Wilson Elser Moskowitz Edelman & Dicker LLP
Article

Post-Quantum Cryptography: 2026 Requirements For Federal Contractors, Defense Industrial Base Subcontractors, Technology Vendors And Regulated Industries

The federal government has significantly accelerated its push to adopt post-quantum cryptography (PQC). Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, signed in June 2026, and OMB Memorandum M-26-15 establish hard federal migration deadlines and extend compliance expectations to the private sector through federal procurement.
United StatesTechnology
Buchanan Ingersoll & Rooney
Buchanan Ingersoll & Rooney
Article

Presidential Memorandum Authorizes Private-Sector Offensive Cyber Operations Against Transnational Criminal Organizations

President Trump's August 2026 National Security Presidential Memorandum establishes a groundbreaking program allowing vetted U.S. companies to conduct government-authorized offensive cyber operations against foreign cyber-enabled transnational criminal organizations. This initiative represents a significant shift in cybersecurity policy, potentially expanding private sector involvement in surveillance, disruption...
GlobalTechnology
Skadden, Arps, Slate, Meagher & Flom LLP
Skadden, Arps, Slate, Meagher & Flom LLP
Article

Rising Cyberattacks On U.S. Water Infrastructure: Federal Guidance And Next Steps For Operators

Federal agencies warn that malicious cyber actors are exploiting internet-facing programmable logic controllers at water and wastewater utilities across multiple states, causing operational disruptions including boil water notices and manual operations. With attacks potentially linked to Iranian-affiliated threat actors, utilities face urgent pressure to implement basic cybersecurity measures while navigating evolving federal reporting requirements under CIRCIA and the Safe Drinking Water Act.
United StatesTechnology
Foley Hoag LLP
Foley Hoag LLP
Article

SBA Extends Deadline For Comments On Historic Overhaul Of Size Standards

The Small Business Administration has extended the comment period for two proposed rules that could dramatically reshape federal government contracting by significantly expanding the pool of entities eligible for small business set-aside procurements. With some size standard thresholds proposed to increase as much as tenfold, these changes would fundamentally alter the makeup of the small business contractor base.
United StatesGovernment, Public Sector
Crowell & Moring LLP
Crowell & Moring LLP
Article

The Lindsey Graham Sanctions Act: What Businesses Need To Know About The New Tariffs

President Trump signed the Lindsey O. Graham Sanctioning Russia and Iran Act into law on September 18, 2026, establishing mandatory tariffs of up to 500% on Russian goods and up to 100% on goods from countries that continue to buy Russian energy. The Act targets major importers like China, India, and Turkey, with limited relief mechanisms including natural gas exceptions, presidential waivers, and a 270-day winddown period for entities divesting from Russian operations.
GlobalInternational Law
Crowell & Moring LLP
Crowell & Moring LLP
Article

DOT Final Rule Narrows Airline Delay And Cancellation Reporting Obligation Under FAA Reauthorization Act Of 2024

The U.S. Department of Transportation has issued a final rule fundamentally restructuring how airlines report flight delays and cancellations, creating a new reporting category that removes ten specific events from the traditional "Air Carrier" category. This regulatory change, mandated by the FAA Reauthorization Act of 2024 and effective October 2026, will significantly impact how airline performance is measured and perceived by consumers, while reducing carriers' customer service obligations for certain
United StatesTransport
Crowell & Moring LLP
Crowell & Moring LLP
Article

U.S.-China Trade Truce Extended Two Months: BIS Affiliates Rule Suspension Follows

The U.S.-China trade truce has been extended through January 10, 2027, pushing back the effective date of the Bureau of Industry and Security's Affiliates Rule. While the suspension delays immediate compliance obligations, the rule remains in place and companies should use this additional time to prepare their compliance programs before the suspension potentially expires.
GlobalInternational Law
Crowell & Moring LLP
Crowell & Moring LLP
Article

White House Announces AI Responsibility Accord, Executive Orders, And Super Intelligence Task Force

The Trump Administration has introduced a voluntary regulatory framework for artificial intelligence through the White House Accord on Super Intelligence, signed by six leading tech companies. This new approach emphasizes corporate self-policing with safety audits and board oversight, while simultaneously rebranding government AI terminology and establishing a new interagency coordination force. How will this light-touch regulatory strategy balance innovation with mounting safety concerns as AI capabilities
United StatesStrategy
Crowell & Moring LLP
Crowell & Moring LLP
Article

EU Steel Overcapacity Regulation: New Permanent Measure In Force From 1 July 2026

The European Union has replaced its expiring steel safeguard measures with a permanent Steel Overcapacity Regulation, cutting duty-free steel imports by an average of 47% and raising the out-of-quota tariff from 25% to 50%. The new framework introduces a complex tariff-rate quota system distributed across 26 product categories, with country-specific allocations based on historical import shares and special treatment for FTA partners. A groundbreaking "melt and pour" traceability requirement will gradually s
European UnionInternational Law
Crowell & Moring LLP
Crowell & Moring LLP
Article

CBP Issues Notice Of Rulemaking On Executive Order 14411, “Strengthening Customs Enforcement”

U.S. Customs and Border Protection is considering sweeping regulatory changes that would require importers to provide unprecedented visibility into their supply chains, including foreign export documentation, global business identifiers, and AI-driven tracing technologies. These proposed amendments stem from Executive Order 14411 and could fundamentally reshape compliance obligations for companies importing goods into the United States. CBP is seeking public comment on 64 questions by December 1, 2026, offe
United StatesInternational Law
Crowell & Moring LLP
Crowell & Moring LLP
Article

It’s LIVE: The Cyber Resilience Act Reporting Is Mandatory as of Today - 11 September 2026

Manufacturers of connected products must now comply with the EU Cyber Resilience Act's vulnerability and incident reporting obligations through ENISA's newly launched Single Reporting Platform. This comprehensive guide addresses the critical question every manufacturer faces: can your organization report a cybersecurity incident within 24 hours if one occurs tonight?
European UnionCorporate/Commercial Law
Crowell & Moring LLP
Crowell & Moring LLP