White House gives agencies 90 days to rewrite national-security AI rules

The White House has moved national-security AI policy from broad ambition into a set of near-term deadlines. On June 5, 2026, it published NSPM-11, directing defense and intelligence agencies to accelerate AI adoption, update autonomy guidance, revise procurement processes, and build assurance rules for systems used in high-consequence missions.

The memorandum is organized around four pillars: adoption, adaptation, assurance, and accountability. Agencies are told to identify mission areas where AI can improve operational effectiveness, remove barriers to deployment, and work closely with industry so advanced frontier models are available to national-security professionals without delay. The memo also supports adapting commercial and open-source technologies when they fit the mission.

The deadlines are the real policy signal. Within 90 days, the Secretary of War must update DOD Directive 3000.09 on autonomy in weapon systems, with annual reviews after that. Within the same 90-day window, relevant officials must issue policy for AI governance in national-security systems, and a classified annex is due for sensitive issues. Within 120 days, defense and intelligence leaders must review procurement processes so the most advanced AI models from multiple vendors can be onboarded faster.

Vendor dependency is treated as an operational risk. NSPM-11 directs agencies to use contract clauses or other mechanisms so no commercial entity or adversary can disable, degrade, or materially modify an AI system that U.S. personnel depend on without federal approval. That language reflects a practical concern: once AI becomes part of command workflows, intelligence analysis, cyber defense, or battlefield support, service continuity becomes a national-security issue.

The memo also calls for high-security computing facilities, an AI test range for national-security use cases, joint red-team exercises with willing private companies, defenses against malicious distillation attacks, and stronger physical and cyber security for data centers. It starts work on an AI National Security Strategic Reserve, a pool of non-government AI talent that can support federal efforts when needed.

The civil-liberties section says national-security AI must not be used for unlawful surveillance, censorship, or ideological bias, and that commanders and agency heads remain accountable. The hard part will be implementation. Faster onboarding and multi-vendor access can reduce capability gaps, but they also raise the burden on testing, audit trails, incident response, and human control. The next useful evidence will arrive when the 90-day autonomy and governance updates show how those tradeoffs are written into operational rules.