US Department of Defense requires human review of AI-generated code

US Department of Defense Directive 8430.01, "Accelerating Mission Software," took effect on September 8, 2026, stipulating that code generated or modified by AI is uniformly treated as unverified input and must be reviewed and tested to the same standards as human-written code, with the models, versions, and datasets used recorded. The directive requires that changes involving safety-critical functions (where a vulnerability could allow an attacker to gain access) or life-safety-critical functions (where a vulnerability could cause loss of personnel or platforms) must be approved by a human. Approved AI services must ensure that government data and prompts are not used to train external models, and that non-public Department of Defense information remains within approved Department of Defense systems. The directive also mentions that dependency-scanning automated remediation (currently in testing) is one example of agentic execution work where reviewers must still sign off. All of the above requirements come from the text of the directive; its actual implementation results have not yet been disclosed.

AI overview based on source reports · Updated 6 hr ago