H.R. 8408 — Legacy IT Reduction Act of 2026

This section defines terms used in the Act, including “Administrator” (Administrator of General Services); “agency” (an agency described in 31 U.S.C. 901(b)(1) or (2)); “Chief Information Officer” (designated under 44 U.S.C. 3506(a)(2)); “Comptroller General” (Comptroller General of the United States); “congressional oversight committee” (a committee or subcommittee of the Senate or House providing agency oversight); “Director” (Director of the Office of Management and Budget); “information technology” and “national security system” (as defined in 40 U.S.C. 11101 and 11103, respectively); and “IT working capital fund,” “legacy information technology system,” and “Technology Modernization Fund” (as defined or established in the National Defense Authorization Act for Fiscal Year 2018).

This section directs the Chief Information Officer of each agency to compile an inventory of legacy information technology systems used, operated, or maintained by the agency, not later than one year after enactment and every five years thereafter. The Director must issue guidance prescribing inventory contents, to include for each system the name or identifier, supported office or mission and its usage, connections to non-legacy systems, last update date, annual operating or maintenance costs (including subscriptions and contract labor), vendor contact information (if available), and next expected update, modernization, retirement, or disposal date. Agency heads must provide the inventory or relevant portions upon request to a House of Congress, agency oversight committees, the Comptroller General, or agency inspectors general; the Director may require its inclusion in agency reporting structures.

This section requires the head of each agency to develop and include, as part of the agency's information resource management strategic plan under section 3506(b)(2) of title 44, United States Code, a plan to modernize the agency's legacy information technology systems—not later than two years after the date of enactment of this Act and every five years thereafter. The modernization plan must include (1) an inventory of the agency's legacy IT systems; (2) identification of systems prioritized for updates, modernization, retirement, or disposal; (3) steps the agency intends to take toward those actions during the subsequent five-year period; and (4) additional information determined necessary by the Director, such as agency capacity to operate modernized systems, estimated costs and funding sources, adaptability to policy or technology changes, and effects on connected non-legacy systems. Within 30 days of submitting the information resource management plan, the agency head must submit the modernization plan to the Senate Committee on Homeland Security and Governmental Affairs, the House Committee on Oversight and Accountability, and each congressional oversight committee of the agency.

This section directs the Director of the Office of Management and Budget (OMB), in coordination with the Administrator of the Office of Electronic Government, to issue guidance on implementation of this Act not later than 180 days after the date of enactment. The guidance must include (1) criteria to determine whether information technology qualifies as a legacy information technology system for the inventory required under section 3(a)(1); (2) instructions and templates for compiling that inventory; (3) instructions and templates for compiling, publishing, and updating the modernization plans required under section 4(a); and (4) any other necessary guidance, including how implementation of this Act complements other laws, regulations, and guidance on information technology modernization.

This section directs the Comptroller General of the United States to submit to the Senate Committee on Homeland Security and Governmental Affairs and the House Committee on Oversight and Accountability, not later than three years after the date of enactment of this Act, a report on (1) implementation of this Act and (2) how this Act functions alongside other federal information technology modernization offices, policies, and programs (e.g., Technology Modernization Fund and IT working capital fund; Federal Risk and Authorization Management Program, 18F program, and 10X program of the General Services Administration; programs and policies of the Office of Management and Budget, including the Office of Electronic Government and United States Digital Service; and any other relevant federal office, policy, or program).

This section exempts (1) sensitive information protected from disclosure by other laws or that would compromise federal IT system security from disclosure requirements of the Act; and (2) national security systems from the Act's inventory, reporting, or transfer requirements. The section further provides that nothing in the Act authorizes transfers of legacy IT systems or equipment to the Chinese Communist Party, the People's Republic of China, or any PRC-controlled entity.

This section (1) authorizes no additional appropriations to carry out the Act and (2) terminates the Act effective six years after the date of enactment.