White House issues the National Security Memorandum on Artificial Intelligence

The National Security Memorandum on Artificial Intelligence (NSM) is a presidential directive telling US national security and intelligence agencies how to adopt AI quickly while managing its risks. On October 24, 2024, the White House released the NSM, describing it as a first-ever action of its kind.

What it is

The document falls under the category of communications to federal agencies concerning artificial intelligence, efforts to advance U.S. leadership, fulfill national security objectives, and foster safety, security, and trustworthiness. The memorandum fulfills a requirement that White House national security officials develop and submit an AI NSM to guide adoption of AI capabilities in support of U.S. national security and address potential uses of AI by adversaries and other foreign actors, a duty set out in Executive Order 14110. A classified annex addresses additional sensitive national security issues in greater detail, including countering adversary use of AI that poses risks to US national security.

What it requires

The NSM directs the Pentagon and other US national security agencies to increase their adoption of AI technologies in a safe and responsible, but expedited, manner. It directs the Department of Commerce, acting through NIST's U.S. AI Safety Institute, as the primary U.S. point of contact with private sector AI developers, to establish voluntary, unclassified, pre-deployment safety testing of frontier AI models. The NSM also directs the NSA's AI Security Center to develop, within 120 days, the capability to perform rapid systemic classified testing of AI models' capacity to detect, generate, and/or exacerbate offensive cyber threats. Section 3.3(f) further requires agencies to collaborate with Commerce, acting through the AI Safety Institute, to implement evaluations of AI systems specific to cyber, nuclear, and radiological risks, sharing results within 30 days of completion. The NSM goes on to require interagency publication of guidance concerning known AI cybersecurity vulnerabilities and threats as well as best practices for addressing them.

What security leaders should do

Security leaders at companies that support national security systems should expect contractual and testing obligations tied to AI Safety Institute pre-deployment evaluations and should prepare to share red-team or safety-testing results with government counterparts on tight timelines. Teams should map which of their products could be classified as national security systems under this memorandum and build a process for rapid disclosure of AI cybersecurity vulnerabilities, since the NSM calls for interagency guidance and reporting channels on exactly that kind of weakness. Because the memorandum ties into Executive Order 14110's broader AI governance structure, security leaders should track companion OMB guidance for non-national-security systems to keep internal AI risk management practices consistent across both tracks.