Three weeks from now, the War Department owes Congress a report that could matter far beyond the Pentagon. Section 1512 of the fiscal 2026 defense authorization law requires a comprehensive review of how the department secures artificial intelligence and machine-learning systems, with findings due by Aug. 31. The law asks for current practices, identified gaps, commercial runtime-security options, alignment with industry frameworks, and recommendations for additional authorities or resources. That deadline arrives at an unusually useful moment. President Donald Trump signed Executive Order 14409 on June 2 to accelerate AI-enabled cyber defense while explicitly rejecting the idea that security requires a new licensing regime for AI development. Then, on July 13, the Pentagon suspended Phase II of the Cybersecurity Maturity Model Certification program, which had been scheduled for Nov. 10, and launched a review aimed at reducing compliance burden while preserving cybersecurity. The administration has therefore set a clear direction: move faster, cut bureaucracy, and keep the security requirement real. Recommended Stories The Aug. 31 report should be judged against that standard. A useful review will identify which AI-security controls actually change operational risk, which can be measured continuously, and which should become enforceable contract terms. The risk is that the review translates the new technology into familiar compliance language and leaves program managers with another checklist that says little about what happens when a model is manipulated at runtime. Congress already gave the department the structure for the next step. Section 1513 requires a risk-based security framework for AI systems acquired by the Pentagon. It directs the department to cover supply chain risks, data poisoning, adversarial tampering, unintended exposure, continuous monitoring, and incident reporting. It also tells the Pentagon to extend or augment existing cybersecurity frameworks, including CMMC, and to amend the Defense Federal Acquisition Regulation Supplement or take