Six of Ten Pentagon AI Programs Flagged Operational Risk. The Office That Teaches Responsible AI Has Three of Ten Staff

The Government Accountability Office published a review on October 14 that gives an unusually direct look at how the Pentagon builds AI into weapons and decision tools, and NPR reported its contents on October 23. The auditors surveyed 10 officials responsible for 10 programs that use AI to identify targets on the battlefield, process surveillance and improve tactical decision making. Those programs sit inside a portfolio of more than 300 that the department is building with AI.

Six of the 10 officials said their teams had "identified risk(s)" with using the projects "in an operational environment". That is the survey's own phrasing, and it is a narrower finding than a systemic failure: most of those interviewed had taken at least initial steps toward the department's guidance, and some of the programs were still early in development, a point Alissa Czyz, who directed the review, emphasised.

The guidance in question is a 2021 memo setting out six tenets for responsible military AI. They stress Pentagon-wide oversight, verification, "real-time monitoring" of the technology, and cooperation with allies to advance shared norms. Czyz described the memo as guidance rather than binding rules. "It is a memo, right, at the end of the day, so it is not a department instruction," she said. "It is something that the department has signalled that should be implemented."

Where the answers diverged from the guidance is specific. Four officials told the GAO that requirements for the weapons and tools they were building were not "aligned with Responsible AI tenets". Three of the 10 said they "do not know" whether their projects would be continuously monitored once deployed, despite real-time monitoring being one of the six principles. Officials also told the auditors that better access to expertise about the guidance, or to staff who understand it, would improve their ability to build AI responsibly.

That request runs into a staffing problem. The department's Responsible AI Division, the group that manages education on the tenets, was authorised to hire 10 people in 2023. As of February, three of those positions were filled, and the report states the Pentagon "is unlikely to fill vacant positions or increase staffing". Czyz put it plainly: "That is a very small number of folks tasked with a large responsibility of responsible AI throughout the department."

The GAO made two recommendations. The Pentagon should define more clearly the responsibilities and meeting schedules of the office charged with overseeing AI regulation, and it should address the understaffing. The department agreed with both. As of October 22, a GAO representative confirmed, neither had been implemented. The Pentagon did not respond to NPR's request for a timeline.

The context makes the gap sharper. A January memo committed the department to becoming "an AI-first warfighting force across all components, from front to back". Last month Defence Secretary Pete Hegseth announced a new warfare command focused on autonomous weapon development, including drones. In a January speech he argued that oversight cycles are themselves the problem: "Our enterprise currently operates on staffing and committee cycles measured in months and years, and that is unacceptable." He added that "military AI is going to be a race for the foreseeable future where the risks to U.S. national security of moving too slowly outweigh the impacts of imperfect alignment".

What the report documents is not a policy vacuum but an enforcement gap, and the staffing figure is the evidence. Principles that promise oversight, verification and real-time monitoring are inexpensive to publish and expensive to staff, and the distance between those two costs is where the finding lives. It also lands in a week when outside researchers published an audit of a commercial lab's agent-monitoring stack and found several ways around it, which points at the same structural issue from the vendor side: supervision is the layer everyone writes down and almost nobody funds. For teams deploying systems that make consequential calls, the transferable lesson is procedural. Name the reviewer, name the review cadence, and make sure the person doing the reviewing has the hours to do it, because a tenet in a memo does not supervise anything.