What GAO Actually Found
DoD adopted five AI Ethical Principles in a February 2020 Secretary of Defense memorandum: responsible, equitable, traceable, reliable and governable. A May 2021 Deputy Secretary of Defense memorandum reaffirmed them and set six foundational tenets for implementing them. The June 2022 Responsible AI Strategy and Implementation Pathway then defined 64 lines of effort, organized by those tenets and assigned to DoD organizations, aimed at building the tools, processes and resources needed to incorporate the principles into each stage of the AI life cycle.
The numbers. As of April 2026, CDAO documentation showed 29 of the 64 lines of effort were incomplete, according to GAO. That is a count of tracked items, not a quality score. CDAO officials told GAO that many lines of effort assigned to DoD components are also incomplete, and GAO noted that CDAO has not developed metrics to measure Responsible AI implementation, even though the Pathway directs it to.
The staffing gap. According to CDAO officials, a 2023 resourcing memorandum authorized CDAO 10 Responsible AI positions, including a systems engineer, a program manager and an AI ethicist. As of February 2026, only 3 of those 10 positions were filled. Officials said staffing shortages have hindered CDAO's ability to take the additional actions it has identified as needed. They also said CDAO is unlikely to fill the vacancies or increase staffing while it restructures under its realignment to the Under Secretary for Research and Engineering and absorbs the January 2026 AI strategy. GAO notes that the Pathway's very first line of effort was to fully staff CDAO's Responsible AI office.
The coordination vacuum. DoD has used the Responsible AI Working Council as its permanent working-level collaborative group since May 2021; CDAO's Responsible AI Division now leads it. The council has no charter assigning roles, responsibilities or meeting frequency, although the Pathway called for one approved by the CDAO. CDAO officials acknowledged it did not meet from late 2024 until August 2025, saying work on a generative AI toolkit and a government-wide AI risk-management effort kept the division from organizing meetings. Officials from four DoD components told GAO they faced Responsible AI implementation challenges during that period that would have benefited from collaboration. The Joint Staff, for example, had used the council to coordinate completion of Pathway lines of effort. In GAO's survey, six of ten components said sharing Responsible AI resources and best practices would increase their ability to incorporate the six tenets into their use case. The council resumed meeting in August 2025, but GAO concluded that without a charter it is at risk of lapsing again.
GAO made two recommendations to the Secretary of Defense. First, ensure the CDAO develops and issues a charter for the Working Council that outlines roles and responsibilities, includes the Responsible AI Division (or equivalent office) and DoD components, and specifies how often the council meets. Second, ensure the CDAO addresses the Responsible AI Division's workforce needs. DoD concurred with both by email. GAO also asked Congress to consider directing DoD to implement older, still-open GAO recommendations from 2022 and 2023 on AI collaboration roles and AI workforce management. As of October 27, GAO's product page lists the two recommendations and the matter for Congress as open.
Why the Timing Is Consequential
A governance shortfall in an office overseeing slowly fielded systems would be a medium-term management problem. The same shortfall in an office expected to govern rapid fielding at scale is a different problem.
Consider the current context. In January 2026, the Secretary issued the Artificial Intelligence Strategy for the Department of War: Accelerating America's Military AI Dominance. It calls for an "AI-first" warfighting force, launches pace-setting projects across warfighting, intelligence and enterprise missions, and states that the risks of not moving fast enough outweigh the risks of imperfect alignment. On September 30, Secretary Hegseth announced AUTOWARCOM, a four-star functional combatant command for autonomous warfare targeted for October 1, 2027, with Project Agincourt as the interim effort. Agincourt's leaders wrote in their October 21 open letter that "competitions, exercises and combat performance will determine which systems scale, and which are cut." The FY2027 budget request includes $53.6 billion for Drone Dominance: $39.2 billion for autonomous systems procurement, domestic production capacity and advanced capabilities, and $14.4 billion for counter-unmanned systems. In August 2025, DoD realigned CDAO under the Under Secretary of Defense for Research and Engineering.
Each of these reflects a stated strategic imperative. Agincourt's leaders argue that low-cost drones have changed the character, speed and economics of warfare. But the Responsible AI office meant to make those systems trustworthy for warfighters has 3 of 10 authorized positions filled, an unchartered council and 29 of 64 lines of effort incomplete.
The strategy also changes what that office must do. Under the heading "Clarifying 'Responsible AI' at the DoW," it directs the department to avoid models with ideological tuning, to use models free from usage-policy constraints that could limit lawful military applications, and to make model objectivity a primary procurement criterion. It also directs CDAO to align all existing AI policy guidance with the memo. GAO reports that the Responsible AI Division has been charged with that alignment task. The same understaffed division is therefore reconciling the 2020 principles and 2022 Pathway with a new definition of Responsible AI while the fielding tempo increases. Programs should expect the guidance they design against to shift during development.
Ten Use Cases, One Low Bar
GAO surveyed ten components (Army, Navy, Air Force, Space Force, Marine Corps, Defense Intelligence Agency, National Geospatial-Intelligence Agency, Defense Threat Reduction Agency, U.S. Special Operations Command and U.S. Cyber Command) on one selected AI use case each. The use cases it profiles include:
- Counter Unmanned Aerial System Pilot
- Robotic Autonomous Systems Using Automatic Target Recognition
- Machine Assisted Geospatial Exploitation (MAGE) Automatic Target Recognition
- Counter-Camouflage Concealment Deception Maneuver Classifier
- Artificial Intelligence Support to Operations
- Detect, Tag, and Track
- Collaborative Heterogenous Autonomous Operations Software
- Redline
- Malware & AI Nexus for Targeted Intelligence Support
- A National Geospatial-Intelligence Agency use case
GAO describes the set as including automatic target recognition and agentic AI. It confirmed the use-case information was current as of March 2026, and it calls the sample nongeneralizable.
The more useful finding is how low the bar was. GAO coded each use case only on whether its survey response described any step toward a tenet, and it notes that DoD has not established measures to assess Responsible AI implementation. Every component took at least one step on governance. The Navy use case had not yet taken steps on requirements validation; its plans were still in development. Only two of the ten use cases had used CDAO's Responsible AI tools, seven had not and one did not know. A step is not a demonstration. Nothing in the survey tells a program whether its traceability documentation or failure-mode analysis would hold up, or who in CDAO would review it.
The Engineering Risk, Not Just the Compliance Risk
Responsible AI is routinely discussed as a compliance requirement, something a program demonstrates to satisfy an oversight body. GAO's findings make that framing dangerous. If the oversight body is understaffed and its coordination forum is unchartered, a program that treats Responsible AI as a box to check at the end of development has no backstop.
The more practical framing is engineering risk. Three of DoD's principles, as defined in the 2021 memorandum, translate directly into design requirements:
- Traceable: relevant personnel must have an appropriate understanding of the technology, development processes and operational methods, including transparent and auditable methodologies, data sources, design procedures and documentation. If a target recognition system flags an object and an operator acts on it, the data and design decisions behind that output must be reconstructable. That is an architecture decision, not a documentation exercise.
- Reliable: capabilities need explicit, well-defined uses, with safety, security and effectiveness subject to testing and assurance within those uses across the entire life cycle. As a hypothetical illustration, a system validated on curated imagery that degrades under weather, camouflage or GPS denial has a reliability problem, unless those conditions were defined and tested as part of its intended use. No policy document fixes that.
- Governable: systems must fulfill their intended functions while being able to detect and avoid unintended consequences, and deployed systems that show unintended behavior must be able to be disengaged or deactivated. A disengagement path has to be engineered, tested and exercised.
None of these properties emerge automatically from a capable model or a fast procurement timeline. They require deliberate design decisions early in development, and someone in the acquisition chain who knows what questions to ask.
The CDAO realignment under USD(R&E) could help or hurt. In May 2026, Andrew Mapes, then acting principal deputy CDAO and now principal deputy, told Federal News Network that the realignment "has enabled us to be much more focused on execution of capability and really working with stakeholders to identify what those enterprise needs are for the department." If that execution focus extends to staffing the Responsible AI Division and chartering the council, it could close the gap GAO identified. But CDAO officials told GAO they are unlikely to add Responsible AI staff while restructuring continues. Until that changes, the acceleration proceeds with thinner governance.
Decision Points for Programs in the Pipeline
If you are working on an AI-enabled program being positioned for Agincourt evaluation, an autonomous systems prototype, or an AI-assisted ISR or C2 capability, GAO's findings suggest three practical checkpoints:
- Who owns the Responsible AI documentation for your program? Not who filed it, but who keeps it current as the system changes through testing, iteration and capability updates. If your program office or your prime contractor's team cannot answer that clearly, do not assume the Working Council will catch the gap.
- What are your program's known failure modes, and are they documented? Responsible AI does not require zero failures. It requires that the people fielding a system understand where it fails, under what conditions and with what operational consequence. A failure-mode analysis done early costs far less than discovering a new failure class during a fielding event in front of an operational force.
- Does your architecture support the oversight posture your acquisition documents claim? As a hypothetical example, a program that describes a human supervising the system, but builds an interface where timely intervention is impractical or disengagement is untested, has a governability problem that no compliance stamp resolves. GAO's survey recorded whether steps were taken, not whether they were adequate, so no oversight finding will vouch for that match. Your test evidence has to.
The credible alternative. Some components are not waiting for CDAO. Air Force and Navy officials told GAO they began building their own Responsible AI governance structures during the council's lapse. The Defense Intelligence Agency published a Quality Assurance Framework with an accreditation process for AI owners. If your component has a functioning process like these, anchoring to it is reasonable. Do confirm that it covers your use case, survives the January 2026 policy realignment, and will be accepted by the transition partner who inherits the system. If your component has no such process, plan to generate the evidence yourself.
Sources and further reading
- GAO-27-107837: Artificial Intelligence: Actions and Opportunities to Implement Responsible Use in DOD — Q&A report to congressional committees, October 14, 2026
- GAO product page for GAO-27-107837 — recommendation and matter-for-Congress status
- Implementing Responsible Artificial Intelligence in the Department of Defense — Deputy Secretary of Defense memorandum, May 26, 2021
- Artificial Intelligence Strategy for the Department of War — Secretary of War memorandum, January 9, 2026
- CDAO Re-alignment to USD(R&E) Accelerates AI Transformation at DoD — CDAO, on the August 14, 2025 realignment
- DoD Moves CDAO Under Research, Engineering Arm — MeriTalk
- Secretary Hegseth Announces Six Major Initiatives at Quantico Speech — Department of War, September 30, 2026
- Project Agincourt Leaders Reach Out to Industry With Path Forward — Department of War, October 2026
- FY2027 Budget Request Overview — Office of the Under Secretary (Comptroller)
- AI & Data Exchange 2026: CDAO's Andrew Mapes on accelerating AI adoption departmentwide — Federal News Network, May 2026
- DOD's AI Oversight Body Lacks Charter, Risks Going Dark Again — Legis1, October 26, 2026
Spartan X works on the assurance side of this problem: assessing how an AI system behaves, watching for drift and error once it is in use, and escalating to people when intervention is needed. Arbiter, which Spartan X is developing, is aimed at surfacing potential problems as an AI instance forms and then monitoring it in use, so reliability questions are raised before fielding rather than reconstructed afterward.
