National Security Presidential Memorandum 11 (NSPM-11), issued June 5, 2026, is the central public presidential direction specifically governing artificial intelligence in the U.S. national security enterprise. It organizes policy around adoption, adaptation, assurance, and accountability. Executive Order 14319 adds federal procurement rules for large language models, with a pathway for National Security System exceptions. Executive Order 14409 and NSPM-12 add cybersecurity requirements. Agency directives, including the Department of War’s Directive 3000.09 and Intelligence Community guidance, fill in mission-specific detail.
The framework is still being implemented. NSPM-11 ordered several policies, a classified annex, and agency updates within 90 or 120 days of June 5, 2026. The public record reviewed through October 13, 2026, does not establish that every deadline product was issued, so an announced requirement should not be mistaken for a completed rule.
The short answer: one central memorandum, several overlapping authorities
There is no single statute or regulation that answers every question about artificial intelligence in national security. The operative framework combines a presidential memorandum, executive orders, Office of Management and Budget (OMB) guidance, National Security Council and Committee on National Security Systems (CNSS) policies, and agency directives.
NSPM-11 applies to the national security enterprise, including the Department of War, the Intelligence Community, and other agencies that develop, deploy, or use National Security Systems (NSS) or otherwise perform a national-security role. It is the most directly on-point public document because its title is Artificial Intelligence in the National Security Enterprise. Its four pillars provide the organizing test for an AI program:
#1 Best Overall
- Adoption: move useful AI into mission work while removing unnecessary barriers.
- Adaptation: tailor commercial or open-source models, or build internally when available tools cannot satisfy mission or security needs.
- Assurance: establish evidence that a system is reliable, robust, steerable, controllable, secure, and compliant with applicable law and policy.
- Accountability: keep human officials responsible and protect constitutional rights, privacy, and civil liberties.
Other authorities do not replace NSPM-11. They address a different layer: procurement principles for federal LLMs, autonomous-weapons policy, general federal AI governance, or cybersecurity of the systems on which national-security AI depends.
What NSPM-11 requires
Adoption: use AI where it improves a mission
The memorandum directs the national security enterprise to accelerate responsible AI use in mission areas and to experiment and validate applications rather than treating innovation as an end in itself. “Adoption” does not mean every office must deploy a model or that a commercial chatbot can be connected to a classified network. It means agencies should identify useful missions, remove avoidable administrative obstacles, and create a path from experimentation to validated operational use.
That path matters because a demonstration is not an authorization. A system that performs well on an unclassified test set may fail when data are incomplete, adversarial, classified, time-sensitive, or supplied by a hostile actor. Adoption therefore sits alongside the assurance requirements rather than overriding them.
Adaptation: configure, fine-tune, or build when necessary
National-security users may adapt commercial and open-source technologies to their missions. Adaptation can include changing a model’s interfaces, retrieval sources, access controls, evaluation sets, or deployment environment. When a commercial product cannot meet security, resilience, or mission requirements, NSPM-11 allows agencies to customize or develop systems internally.
Free tools Windows power users keep installed
One-click scans. No signup required.
The practical implication is that “commercial” and “government-built” are not separate legal categories with automatic approval. Each implementation still has to satisfy the applicable security, testing, legal, and policy controls. A model’s origin does not by itself establish that it is safe for an NSS.
Assurance: prove that the system can be trusted for its use
NSPM-11 describes assurance in operational terms. Systems are expected to be:
- Reliable and robust: they should perform consistently across expected conditions and degrade safely when inputs or services fail.
- Steerable and controllable: authorized operators must be able to direct the system, constrain its behavior, and stop or modify it.
- Secure: the model, data, interfaces, supply chain, and hosting environment must be protected against compromise and misuse.
- Legally and policy compliant: the use must fit governing law, rules of engagement, privacy requirements, and agency policy.
The memorandum calls for rigorous testing, evaluation, validation, and verification (TEV&V), together with security and functionality measures. Those terms describe an evidence-producing process: define the intended use, test representative and adversarial conditions, evaluate results against acceptance criteria, validate that the system addresses the real mission, and verify that the implementation matches its approved design.
Assurance is use-specific. A model approved to summarize public reporting is not automatically approved to recommend collection priorities, control a weapon, or make a decision affecting an individual. The more consequential the use, the more important human review, traceability, fail-safe behavior, and independent testing become.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Accountability: people remain responsible
NSPM-11 preserves human accountability. Commanders, directors, and agency heads remain responsible for decisions made with AI assistance; responsibility cannot be transferred to a model, vendor, or automated pipeline.
The memorandum also prohibits using AI to censor free speech, embed ideological bias, or conduct unauthorized or unlawful surveillance. It states that constitutional protections, privacy safeguards, and civil-liberties requirements continue to apply. These provisions do not create a blanket exemption for national-security activity, nor do they make every AI output a constitutional decision. They require officials to design and supervise systems so that national-security purposes are pursued within the law.
Rank #3
NSPM-11’s implementation agenda and what is confirmed
NSPM-11 is partly a policy directive and partly an instruction to produce more detailed rules. It directed the following work:
| Required product or action | Responsible bodies identified in the memorandum | Timing and public status |
|---|---|---|
| Update DoD Directive 3000.09 | Department of War | Directed within 90 days of June 5, 2026, with annual review; completion is not established in the public record reviewed through October 13, 2026. |
| National-security AI governance policy | CNSS and OMB | Directed within 90 days, with implementation and reporting requirements; issuance is not confirmed in the reviewed public record. |
| Classified annex | Presidential and national-security authorities | Directed within 90 days; its contents are not available in the reviewed public record, and issuance is not confirmed. |
| Agency policy updates and annual reviews | Agencies in the national security enterprise | Required after the government-wide direction; the reviewed sources do not verify that every update was completed. |
| Additional capability, workforce, and testing initiatives | Department of War, intelligence elements, CNSS, OMB, and other agencies | Several actions carry 90- or 120-day directions; individual completion dates must be checked against current agency records. |
The other initiatives include procurement changes to onboard advanced models from multiple vendors; a high-security computing roadmap and possible AI test range; joint AI data and model exchanges; AI security and risk-management baselines; standard national-security TEV&V methods; workforce training; and an AI National Security Strategic Reserve. NSPM-11 establishes the agenda, but an agenda item should not be described as an operating program until the responsible agency has issued the implementing material.
How the main authorities fit together
| Authority | Date and form | Primary scope | What it contributes |
|---|---|---|---|
| NSPM-11 | June 5, 2026; presidential memorandum | National security enterprise and NSS-related missions | Four pillars for adoption, adaptation, assurance, and accountability; implementation and reporting directions. |
| Executive Order 14319 | July 23, 2025; executive order | Federal procurement of large language models | Truth-seeking and ideological-neutrality principles, with OMB guidance directed to make appropriate exceptions for LLMs used in NSS. |
| OMB M-25-21 | April 3, 2025; OMB memorandum | General federal AI use | Governance context and references to DoD responsible-AI guidance, Intelligence Community ethics principles, and DoD Directive 3000.09; it says NSS AI is governed through other policy. |
| Executive Order 14409 | June 2, 2026; executive order | Cybersecurity, especially NSS and Department of War systems | Prioritizes NSS cyber defense and calls for AI-enabled cyber-defense tools and services. |
| NSPM-12 | June 2026; presidential memorandum | Cybersecurity governance for National Security Systems | Re-establishes CNSS coordination, assigns the NSA Director the National Manager role, and makes agency heads accountable for defending systems. |
| DoD Directive 3000.09 | Existing Department of War directive; update ordered by NSPM-11 | Autonomous weapon systems and related human-control policy | Mission-specific reference identified by OMB M-25-21; the status of the NSPM-11-directed update is not confirmed in the reviewed public record. |
These instruments have different institutional forms. An executive order and presidential memorandum direct executive-branch activity but are not congressional statutes. OMB memoranda establish government-wide administrative guidance within OMB’s authority. Agency directives translate presidential and department policy into operational rules, approval processes, and responsibilities. A program office must identify which layer applies instead of treating one document as a universal substitute.
What Executive Order 14319 means for national-security AI procurement
Executive Order 14319 establishes two principles for LLMs procured by federal agencies:
- Truth-seeking: systems should provide truthful, factual responses; pursue accuracy and objectivity; and acknowledge uncertainty.
- Ideological neutrality: systems should not be selected or configured to advance an ideological viewpoint in their federal use.
The order directs OMB to issue implementation guidance. That guidance is expressly expected to account for technical limitations and to make appropriate exceptions for LLMs used in National Security Systems.
The exception pathway is not a declaration that every NSS deployment is exempt. It means the procurement guidance must explain when and how the principles apply in a national-security environment. A buyer still has to document the mission, security controls, data handling, testing evidence, operator authorities, and any approved exception. Nor does a procurement exception cancel NSPM-11’s assurance and accountability requirements.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWhy OMB M-25-21 is useful but not the whole answer
OMB M-25-21 provides the general federal AI-governance context. It expressly recognizes that AI innovation and risk in National Security Systems are managed through other policy. It points readers to the Department of War’s Responsible Artificial Intelligence Strategy and Implementation Pathway, the Intelligence Community’s Principles of Artificial Intelligence Ethics, and DoD Directive 3000.09.
That wording is important. M-25-21 helps an agency understand the government-wide baseline, but it should not be cited as the sole governing framework for an NSS. NSPM-11, applicable security directives, intelligence-community rules, acquisition requirements, and mission-specific authorities may impose additional controls.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Cybersecurity rules are a separate but essential overlay
Executive Order 14409
Executive Order 14409 directs the government to prioritize cybersecurity for National Security Systems and Department of War systems. It also calls for AI-enabled cyber-defense tools and services. The order therefore affects both sides of an AI project: agencies may use AI to defend networks, but the AI system itself becomes part of the environment that must be defended.
NSPM-12
NSPM-12 establishes cybersecurity governance for NSS, re-establishes CNSS coordination, and assigns the NSA Director the National Manager role. It also makes agency heads accountable for system defense. These provisions concern governance and protection of the infrastructure, networks, identities, data, and services surrounding an AI capability. They complement NSPM-11’s rules for responsible AI use; they are not a replacement for model testing or civil-liberties review.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Security questions an implementation must answer
- Where are model weights, prompts, logs, and retrieved data stored and processed?
- Which users, services, and administrators can invoke or change the system?
- How are prompt injection, data poisoning, model theft, exfiltration, and supply-chain compromise tested?
- What happens when connectivity, a dependency, or the model itself fails?
- Can operators audit outputs, reconstruct a decision, revoke access, and shut the capability down?
The answers belong in the system’s security and authorization records, not merely in a vendor description.
How an agency should apply the framework to a new AI capability
- Define the mission and authority. State the operational purpose, users, affected people, data sources, decision rights, and legal authorities. Identify whether the system is an NSS or supports another national-security function.
- Classify the consequence of failure. Distinguish a low-consequence analytical aid from a system that recommends targeting, controls access, allocates scarce resources, or affects an individual. Set stronger review and human-control requirements as consequences rise.
- Choose an acquisition and adaptation path. Decide whether to procure, configure, fine-tune, or build. Apply EO 14319’s procurement principles and document any NSS exception permitted by OMB guidance.
- Design controls before deployment. Specify authorized operators, data boundaries, logging, retention, model-change controls, incident response, fallback procedures, and a means to stop the system.
- Conduct TEV&V. Test representative mission data, edge cases, adversarial inputs, uncertainty, bias risks, cybersecurity threats, and degraded conditions. Validation should confirm that the capability solves the stated mission; verification should confirm that the fielded system matches the approved design.
- Obtain the required approvals. Route the evidence through the agency’s security, legal, privacy, civil-liberties, acquisition, and mission-governance authorities. Do not treat a successful demonstration as operational authorization.
- Monitor and review continuously. Track performance drift, data changes, model updates, incidents, operator overrides, and unintended effects. Re-test after material changes and follow NSPM-11’s annual-review direction when applicable.
Autonomous weapons and human control
Autonomous weapon systems have a distinct policy history. OMB M-25-21 identifies DoD Directive 3000.09 as a relevant reference, and NSPM-11 orders that directive to be updated within 90 days and reviewed annually. The memorandum’s assurance and accountability pillars reinforce the need for reliable, controllable systems and responsible human officials, but the existence of NSPM-11 alone does not establish the detailed authorization criteria of the updated directive.
Until an updated directive is publicly confirmed, readers should distinguish the existing directive, the presidential instruction to update it, and any later implementing text. Those are three different things.
What is known, and what still needs verification
The public directions establish the policy architecture and several deadlines. They do not, in the reviewed record, prove that every follow-on product was issued by its deadline. The 90-day NSPM-11 window fell in September 2026; actions assigned 120 days fell in the following month. The status of the CNSS/OMB governance policy, classified annex, agency updates, DoD Directive 3000.09 revision, and other products should therefore be checked in the latest White House, CNSS, OMB, Department of War, and Intelligence Community releases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →A careful account should use precise verbs: NSPM-11 “directs” a policy, “orders” an update, or “requires” an agency action. It should say a product was “issued” only when an official publication confirms issuance. The classified annex cannot be evaluated from the public record, and an unverified deadline cannot be treated as proof that an internal control exists.
A practical reading guide for viewers, journalists, and researchers
When a documentary, hearing, contract, or agency announcement describes an AI capability, ask four questions:
- Which authority? Is the claim based on NSPM-11, EO 14319, OMB M-25-21, EO 14409, NSPM-12, an agency directive, or a mission-specific rule?
- What scope? Does it concern a general federal LLM purchase, an NSS, an intelligence activity, an autonomous weapon, or cybersecurity?
- What stage? Is the item a presidential direction, an implementation task, an issued agency policy, an authorization, or an operational capability?
- Who remains accountable? Identify the commander, director, agency head, or other official responsible for oversight and legal compliance.
This approach prevents two common errors: claiming that one general AI memo governs every classified use, or assuming that a national-security exception removes civil-liberties, privacy, security, and human-accountability duties.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Say something about this film