Outpaced: AI and Policy’s Role in Transforming Cybersecurity Compliance

Center for Security and Emerging Technology  |  Katherine Carroll

The federal Authorization to Operate (ATO) process and Risk Management Framework (RMF) are severely delaying the deployment of critical commercial software and artificial intelligence capabilities to U.S. warfighters. In a Center for Security and Emerging Technology report authored by Katherine Carroll in August 2026, bureaucratic compliance bottlenecks are shown to create life-threatening operational risks, including instances where software patches were shelved during active operations.

While commercial industry leads in software development, federal security compliance remains an entrenched barrier to military adoption. Existing reform efforts over the past decade have failed because they focus on service-specific inefficiencies rather than addressing foundational legal authorities, governance structures, and competing stakeholder incentives. Crucially, the initial phase of the military software approval pipeline remains largely unaddressed, presenting the primary hurdle for non-traditional commercial vendors seeking defence entry. Resolving these structural delays will require moving beyond superficial process tweaks to reform systemic governance and incentivize cross-agency reciprocity across federal defence acquisitions.

Comment

Prohibitive compliance timelines within the Risk Management Framework directly constrain the defence industrial base by excluding commercial software developers. Commercial artificial intelligence firms engaging with the Defense Innovation Unit frequently abandon military projects due to the prolonged audit cycles required by NIST Special Publication 800-53. This compliance-driven capital burn rate depletes private funding before dual-use software platforms achieve operational authorization.

The resulting market attrition consolidates software procurement among traditional prime contractors capable of sustaining multi-year regulatory overhead. Consequently, major defence acquisition programs like the Army's Integrated Visual Augmentation System risk technical obsolescence when dependent on legacy software suppliers rather than commercial codebases.

Strategic Question for Discussion

Which factor contributes more to the slow integration of commercial artificial intelligence into platforms like the Integrated Visual Augmentation System — statutory compliance burdens under NIST Special Publication 800-53 or institutional risk aversion among military authorizing officials?

The available evidence points toward institutional risk aversion as the primary driver, as military authorizing officials frequently impose local compliance requirements above NIST Special Publication 800-53 baselines to avoid personal accountability for cyber breaches. While statutory frameworks create initial friction, this risk-averse culture prevents the adoption of continuous authority mechanisms that could otherwise streamline software integration for programs like the Integrated Visual Augmentation System.

Share your assessment in the comments below.

To read in details click here