Congress does this often: it passes a law directing an agency to solve a hard problem, and then the real work, the part that determines whether the law means anything, happens quietly inside the executive branch months later.

A provision of last year’s defense authorization act is a clear case. Section 1513 of the Fiscal Year 2026 National Defense Authorization Act directs the Department of War to build a framework governing the cybersecurity of the artificial intelligence systems it buys, folding it into existing acquisition rules and the Cybersecurity Maturity Model Certification program. A first status report to Congress was due in mid-June. The deadline has now passed, and the question that matters is no longer whether the Department will report, but what the framework underneath the report actually does.