US under secretary tasks the Science, Technology and Innovation Board with a study of commercial AI and cloud on classified networks, due in twelve months with options on rules and organisation

The questions: common authorisations, procurement rules, barriers to small firms

The study falls to the board's Permanent Subcommittee on National Security Innovation. The memo's questions cover the feasibility of common security authorisations; whether the DFARS and the Financial Management Regulation support such purchases; barriers facing small businesses and nontraditional contractors; vendor authorisation, network access, facility and infrastructure requirements; and how vendors access customer data across classified environments. The authority cited is Section 907 of the FY2026 NDAA.

The framing reflects a judgment that what holds back AI on classified networks is the regime of authorisation and contracting rather than model performance. The explicit question of vendor access to customer data goes to the heart of the dispute over usage terms: the conditions under which commercial AI firms touch data in classified environments for training or operations.

Organisational options and a warning against 'hidebound' structures

On organisation, the memo puts four options on the table: a new defence agency or field activity, integrating functions into an existing organisation, consolidating development within existing staff organisations, or improving current structures. It warns that 'organizational structures that are excessively siloed, hierarchical, or hidebound by cumbersome processes' may 'prove unequal to this imperative,' extending January's realignment that centralised oversight of the department's innovation offices under Michael. Since May the department has announced agreements with several AI and cloud companies for classified networks; turning that stack of individual deals into an institution is the work still ahead.