Department of Defense (DOD) Chief Information Officer (CIO) Kirsten Davies issued new guidance establishing procedures for artificial intelligence (AI)-assisted software development as the Pentagon adapts its software practices for an era of “software-defined warfare.”
The guidance, “Accelerated Mission Software,” was approved by Davies on Aug. 31 and took effect Sept. 8.
Under the Trump administration, the DOD was rebranded as the Department of War (DOW).
The instruction establishes policy, assigns responsibilities, and sets procedures for software modernization and management across the department. It also promotes software reuse to achieve efficiencies and accelerate capability delivery.
“AI-assisted software development is a significant force multiplier for the delivery of speed and quality,” the document states.
The policy sets security, accountability, and transparency requirements for teams using AI in mission-critical software development.
Under the guidance, developers and development teams remain fully accountable for the security, functionality, and integrity of code generated or modified using AI. AI-generated code is considered unverified input, and AI-generated changes to security- or safety-critical functionality require human review and approval.
The instruction requires AI-suggested or AI-generated code – including software code, scripts, and automated tests – to undergo the same or similar rigorous code review and security testing as manually written code. Before integration into a codebase, code must be reviewed for security vulnerabilities, safety implications, logical errors, subtle bugs, potential intellectual property infringement, license obligations, and proper implementation of security controls.
The guidance also restricts the government information that developers can provide to generative AI tools.
“Non-public DOW information, including code, configuration scripts, infrastructure definitions, schematics, or documentation, may not be entered into or processed by generative AI applications or services unless those applications or services reside on DOW information systems and are approved for use by DOW personnel,” the document states.
For proprietary software development, department components may use only AI applications or services developed with AI cybersecurity requirements defined in the department’s AI Cybersecurity Risk Management Tailoring Guide and explicitly authorized through formal department cybersecurity approval processes.
Approved services must provide contractual guarantees that government data and user prompts will not be shared or used to train public or DOD-external models, and they must allow designated authorities to audit and monitor their use.
“To ensure transparency when using AI, software efforts will maintain a record of models, versions, and significant datasets used to generate or test software,” the document states. “This information will be included as part of the comprehensive software evidence package, analogous to the SBOM, to enable risk assessment and traceability of AI-driven components.”
Beyond AI, the instruction directs the department to prioritize existing software, components, frameworks, and platforms; open source software; and commercial-off-the-shelf and software as a service solutions before developing or acquiring new capabilities. The stated goal is to achieve efficiencies and accelerate delivery.
The guidance makes “Default to Enterprise Reuse” a foundational modern software tenets and directs department components to share custom-developed code in publicly or privately available repositories to enable departmentwide reuse.
Before releasing that code, components must remove personally identifiable information and other sensitive data from the code, documentation, issues, and commit history. The instruction also contains exemptions and additional handling requirements for certain classified, national security, intelligence community, and military- or space-related code.