The Lyceum: AI Intelligence Brief — May 29, 2026

Three converging events define the next 96 hours. First, the Section 1533 Cross-Functional Team statutory deadline expires June 1 with no public CDAO standup; assess with high confidence based on absence of any Federal Register notice, ai.mil publication, or sourced reporting. Second, the HASC FY27 NDAA chairman's mark goes to full-committee markup June 4 — the amendment window for CFT remediation, AI export language, or 3000.09 reconciliation closes inside that window. Third, GAO's May 12 decision ruled BIS's AI Diffusion rescission subject to the Congressional Review Act, converting Commerce's regulatory vacuum into a live congressional lever just as authorizers begin markup. Assess with moderate-to-high confidence that DoD's AI acquisition posture is now structurally ahead of its governance architecture, and that the FY27 NDAA — not BIS — will set the de facto AI export and assessment framework if Commerce does not publish within weeks.

[AUTONOMY][ACQUISITION] DAWG FY27 Request — $54.6B: The Defense Autonomous Warfare Group line jumps from $225M (FY26) to $54.6B in the FY27 request, a 243x increase per single-source reporting. Decision implication: Acquisition leads must verify MOSA/OMS/UCI entry requirements are in solicitation language before FY27 appropriations lock program architecture.

[AUTONOMY][ACQUISITION] JIATF 401 C-UAS IDIQ — $500M, Perennial Autonomy: Three-year IDIQ for Merops interceptors, Bumblebee quadcopters, and Hornet strike drones. Decision implication: Program managers must determine whether this vehicle competes with or feeds Replicator/DAWG procurement lanes before task orders begin obligating.

[INTEGRATION][FOUNDATION] GenAI.mil — 1M users, ~40M prompts: CDAO (ai.mil) reports department-scale generative AI use at CUI levels. Decision implication: Records retention, oversight, and security policy gaps now affect an operational user base, not a pilot.

[INTEGRATION][CYBER] BadHost (CVE-2026-48710) — Starlette host-header auth bypass: Critical bypass in the framework underpinning FastAPI, vLLM, and most LangChain agent backends. Decision implication: AOs should pause accreditation of any FastAPI/Starlette-based AI tool slated for July PSP demos pending patch verification.

[EXPORT][COMPUTE] Alibaba Qwen 3.5-397B-A17B — #3 open-weight on Artificial Analysis: Concrete benchmark signal that Chinese open-weight capability continues to advance. Decision implication: Increases pressure on BIS and Congress to clarify model-weight control scope before allied data-center deals close.

[ACQUISITION] ICE/BI2 — $25.1M no-bid iris contract: Sole-source award anchors 1,500+ mobile scanners and continuous access to a 5M-record biometric repository held by a pre-FedRAMP vendor. Decision implication: The sole-source/pre-FedRAMP pattern is the same one appearing in defense-adjacent AI biometric buys; PMs should treat this as a precedent that becomes hard to unwind once field ops depend on it.

The June 1 deadline is no longer a planning horizon — it is an imminent missed-deadline scenario, and the FY27 NDAA markup three days later is the only realistic backstop. Section 1533 of the FY2026 NDAA requires DoD to stand up a cross-functional team for AI model assessment and to publish a department-wide framework — performance standards, testing procedures, security requirements, ethical use principles — per WilmerHale's NDAA analysis. No Federal Register notice, no ai.mil announcement, no sourced reporting confirms standup. (Contested — CDAO may have initiated internal actions not publicly disclosed; however, the statute implies a published framework, and the chairman's mark prioritizes industrial base over AI governance, meaning remediation amendments must be member-filed and will compete with munitions and shipyard provisions.) The critical unknown is whether USD(R&E) Michael has accepted or disputed CDAO's lead authority — that is the mechanism by which a missed deadline becomes a prolonged jurisdictional dispute. Practical consequence: every AI procurement adjudication between June 1 and CFT publication occurs against no DoD-wide standard. PMs should document independent adjudication rationale before Sunday.

GAO's May 12, 2026 decision (B-337935) holding BIS's Diffusion Rule rescission subject to the Congressional Review Act converts Commerce's regulatory vacuum from an executive housekeeping matter into a congressional object — and it lands precisely as HASC markup amendments are being drafted. There is still no indication whether model-weight controls will return, per Morrison Foerster, and BIS has signaled it may skip notice-and-comment in favor of Interim Final Rules. (Contested — industry lobbied against model-weight controls; Gibson Dunn reads BIS signals as pointing toward a "stronger but simpler" replacement that may omit them.) Every DoD bilateral AI tech-sharing agreement signed in the current vacuum — UAE, Saudi Arabia, India post-Gulf trip — carries retroactive compliance exposure the moment a replacement publishes or Congress legislates. The critical unknown: whether any HASC member files an AI export amendment before June 4. If yes, the NDAA subtitle becomes the de facto control architecture before Commerce acts.

A 243-fold DAWG increase (single-source — moderate confidence pending OMB confirmation) creates acquisition velocity structurally ahead of DoD Directive 3000.09 adjudication capacity. The NDAA 2025 Section 1061 waiver disclosure report (due December 31, 2025) remains unconfirmed as submitted, meaning Congress has no current accounting of which programs carry autonomous targeting authorities. If FY27 appropriates $54.6B before the Section 1061 report is reconciled, acquisition leads will obligate funds against an unverified compliance posture. Defense One reporting on USD(R&E) Michael's multi-vendor posture reinforces that the portfolio architecture is outrunning governance. (Contested — DoD has not publicly acknowledged a Section 1061 reporting gap; no congressional inquiry confirmed in open sources.) The remaining unknown: whether any of the seven PSPs approaching July 2026 demos carry autonomous targeting functions requiring adjudication before being framed as operational capability.

[GOVERNANCE] Gap — Section 1533 CFT internal status and jurisdictional lead. Whether CDAO has notified Congress or initiated non-public standup, and whether USD(R&E) accepts CDAO lead authority, is unknown. Matters because: if internal action exists but is unpublished, the gap is administrative; if not, every AI acquisition adjudication after June 1 lacks statutory basis. Watch for: Federal Register notice or ai.mil publication before June 1; silence through June 2 is itself a reportable event.

[EXPORT] Gap — BIS replacement rule timeline and model-weight scope. BIS has not signaled when or whether model-weight controls return (Morrison Foerster). Matters because: allied AI data-center co-investment agreements cannot be finalized without knowing the control surface; agreements signed in the vacuum carry retroactive exposure. Watch for: pre-publication notice or ANPRM from BIS; HASC amendment text filed before June 4 markup.

[AUTONOMY] Gap — PSP demo framing relative to 3000.09. Whether any of the seven July 2026 PSP demos carry autonomous targeting functions is not publicly confirmed. Matters because: if framed as "operational capability" rather than "experimentation," 3000.09 adjudication becomes a pre-condition and Section 1061 oversight exposure attaches. Watch for: DepSecDef or USD(R&E) language characterizing demo scope; CDAO publication of demo criteria.

• [GOVERNANCE] If CDAO publishes no Section 1533 CFT standup notice by June 1, 2026 → AI acquisition adjudication shifts from "pending standard" to "no standard"; PMs must document independent rationale immediately, as every post-June 1 AI model procurement carries FY2026 NDAA statutory exposure.
• [EXPORT] If any HASC member files an AI export or CFT-remediation amendment before the June 4, 2026 markup → the FY27 NDAA subtitle becomes the de facto AI governance and export control vehicle, preempting BIS; DoD bilateral allied AI tech-sharing negotiations should pause pending architecture confirmation. GAO's CRA determination makes congressional preemption procedurally easier.
• [AUTONOMY][ACQUISITION] If USD(R&E) Michael or DepSecDef publicly characterizes any July 2026 PSP demo as "live operational capability" → 3000.09 adjudication becomes mandatory pre-condition; any gap triggers Section 1061 oversight exposure and creates competitor protest surface.
• [EXPORT][COMPUTE] If BIS publishes any Federal Register pre-publication notice or ANPRM for the AI Diffusion replacement before July 4, 2026 → model-weight controls move from ambiguity to active rulemaking; current allied AI data-center co-investment agreements must be reviewed for retroactive compliance exposure within 30 days.

Sourcing quality is mixed. The Section 1533 deadline assessment rests on confirmed statutory text plus verified absence of public standup across Federal Register, ai.mil, and defense press — high confidence. BIS analysis draws on converging Tier 1/2 legal sourcing (Gibson Dunn, Morrison Foerster, WilmerHale) plus authoritative GAO opinion — high confidence on the regulatory vacuum, moderate on legislative response. The DAWG $54.6B figure is single-source (Technocracy News) and should be treated as moderate confidence pending OMB confirmation. USD(R&E) Michael's 1,775% AI growth claim is an unverified official assertion and is flagged as such. The HASC markup date and topline are confirmed via committee release; the amendment queue is not yet public.