NDAA 2026: Pentagon excludes Chinese AI vendors before it can actually vet them

The National Defense Authorization Act for Fiscal Year 2026 (NDAA FY2026), whose conference report was unveiled on December 7, 2025, contains several structural AI provisions for the Department of Defense (DoD). Among them: a Department-wide AI cybersecurity policy covering the full system lifecycle, due within 180 days, and a standardized AI model assessment framework led by the Chief Digital and AI Officer — operational by June 1, 2026, but with assessments not fully completed until January 1, 2028.

At the same time, the NDAA requires the DoD to exclude AI systems from named Chinese companies — DeepSeek and High Flyer are specifically cited — within 30 days, and the entire intelligence community within 60 days. This measure takes near-immediate effect, well before the model assessment framework is ready to run at full capacity.

The gap between the two timelines is stark: a quality and security verification instrument that will take up to 19 months to become fully operational (June 2026 to January 2028), versus a nationality-based exclusion enforceable within weeks. Absent a reliable, generalizable measurement tool, a vendor's country of origin serves in the meantime as the default filter.

The legislation includes other notable provisions for industrial contractors: a Department-wide AI experimentation "digital sandbox" environment, expected by April 1, 2026; an AI Futures Steering Committee on advanced AI risk, co-chaired by the Deputy Secretary of Defense and the Vice Chairman of the Joint Chiefs of Staff, with a public report due January 31, 2027; and $150 million per year over two years allocated to the Treasury Department to restrict outbound investment in Chinese defense and surveillance technology. For aerospace and defense suppliers under DoD contract, this compliance timeline is worth anticipating now, well ahead of the 2028 deadline.