DoD Launches Review of Commercial AI and Cloud on Classified Networks

On October 27, 2026, Emil Michael, Under Secretary of Defense for Research and Engineering, directed the Science, Technology and Innovation Board to study how the Department of Defense (DoD) can use commercial artificial intelligence and cloud services on classified networks and improve the organization of digital solutions engineering and software delivery. The memorandum was published October 30. The review is scheduled to begin by November 26, 2026, and conclude within 12 months. It is a policy and organizational review—not a solicitation, contract action, or funding announcement—so its immediate value to contractors is advance visibility into questions that could inform future acquisition practices and authorization pathways.

The study will assess technical, security, and acquisition requirements for commercial providers operating in classified environments. The board is tasked with examining the feasibility of common security authorizations, whether current procurement regulations adequately support commercial services, and which organizational roles and authorities are needed to address adoption barriers. This scope matters to vendors whose products or services rely on repeatable security approvals and access to classified customer networks: findings could influence how providers demonstrate compliance, obtain network access, and support services across multiple DoD customers. The review also specifically examines barriers facing small and nontraditional defense contractors, making participation requirements and approval burdens central issues rather than incidental considerations.

A second major track concerns the structure of digital solutions engineering and software delivery within the Office of the Secretary of Defense (OSD). The board will consider several organizational options: establishing a new defense agency or field activity, integrating functions into an existing organization, consolidating development responsibilities within existing staff organizations, or improving current structures and authorities. Michael’s memorandum argues that “All-domain dominance is underpinned by rapid, nimble, and leading-edge digital hardware and software acquisition and engineering practices,” and warns that structures that are “excessively siloed, hierarchical, or hidebound by cumbersome processes” may not meet that need. These alternatives could eventually affect where requirements are managed, how digital solutions are engineered, and which offices shape acquisition decisions, although the review itself does not establish a new organization or change current procurement rules.

The Permanent Subcommittee on National Security Innovation will conduct the study. For classified commercial cloud, its assessment covers strategic and operational benefits across applications, infrastructure, data, artificial intelligence, and computing resources. It will examine how vendors obtain authorization, network access, and accounts to build, certify, procure, and sustain services, as well as requirements for physical facilities and computing and networking infrastructure. The subcommittee will also consider how vendors access customer data across classified network environments and what approvals are needed when offerings serve multiple military departments, DoD components, and defense intelligence organizations. In particular, the review will assess authority-to-operate processes and the feasibility of reciprocal or common authorization frameworks.

• The directive is dated October 27, 2026; the memorandum was published October 30, 2026.
• The review is to begin by November 26, 2026, and finish within 12 months.
• Commercial AI and cloud services on classified networks are in scope, including applications, infrastructure, data, AI, and computing resources.
• The board will evaluate common or reciprocal security authorizations and requirements for serving multiple military departments, DoD components, and defense intelligence organizations.
• Vendor-access issues include authorization, network access, accounts, customer-data access, facilities, and computing and networking infrastructure.
• Acquisition analysis will consider whether existing procurement regulations adequately support commercial digital services and identify adoption barriers.
• The study explicitly addresses barriers to participation by small and nontraditional defense contractors; companies can review their security authorization and vendor-access approaches against the topics under examination.
• Organizational alternatives range from creating a new defense agency or field activity to integrating, consolidating, or improving existing digital engineering functions and authorities.
• The memorandum links faster digital acquisition and engineering to “all-domain dominance,” while criticizing overly siloed or cumbersome structures.
• No immediate bid opportunity, contract award, or policy change is created; procurement teams should monitor the study’s eventual findings for potential changes to acquisition and authorization practices.