The Insider Threat Reporting and Security Guidance Act of 2026 requires the Secretary of Defense to establish security reporting rules for large artificial intelligence contractors working with the Pentagon. The law applies to contractors with Defense Department AI contracts valued at $100 million or more and that have spent at least $1 billion on AI research and development in the preceding three years. Within 180 days of enactment, the Defense Secretary must issue regulations requiring these contractors to report their security practices related to personnel vetting, insider threat prevention, access controls, and supply chain security, as well as any known security breaches or incidents involving their AI systems. Additionally, contractors must notify the Defense Department within 72 hours of discovering acute national security risks and must certify every 90 days that their submitted information remains accurate. The bill also directs the Defense Secretary to issue voluntary security guidance for these contractors by the same 180-day deadline and to update that guidance after completing a one-year risk assessment, with a final report to Congress due within one year of enactment.