A bill to provide for the delivery of artificial intelligence functional bills of materials, and for other purposes.
- Sponsor
- Sen. Slotkin, Elissa [D-MI]
- Committees
- Armed Services Committee (primary)
- Last action
- Aug 6, 2026
Bottom line
The bill aims to enhance the security and transparency of AI systems procured by the Department of Defense by requiring comprehensive disclosure of their underlying components from contractors.
What it actually does
This bill mandates the Department of Defense (DoD) to revise its acquisition regulations, requiring contractors providing artificial intelligence (AI) goods or services to submit and maintain a detailed 'artificial intelligence functional bill of materials' (AI fBoM). This fBoM must comprehensively detail the software, data, and hardware components of the AI system, be machine-readable, and enable timely assessment of vulnerabilities. It also extends existing software bill of materials (SBoM) policies to AI systems and requires guidance on secure storage of these fBoMs.
Proponents argue
Supporters argue that this legislation is critical for national security, enabling the DoD to proactively identify and mitigate vulnerabilities in AI systems used in defense applications. It ensures supply chain integrity, provides a clear understanding of acquired AI technologies, and promotes accountability from defense contractors in the rapidly evolving AI landscape, ultimately safeguarding military capabilities.
Opponents contend
Critics might contend that these extensive disclosure requirements could impose significant compliance burdens on defense contractors, particularly smaller businesses or those developing cutting-edge, proprietary AI. This could potentially stifle innovation, increase procurement costs, or slow down the adoption of advanced AI technologies by the DoD due to the complexity of maintaining such detailed, real-time bills of materials for rapidly evolving systems.
The bill is concise and focused, allowing an informed reader to understand its core provisions and implications within a reasonable timeframe.
Section 1(a)
Requirement for Artificial Intelligence Functional Bill of Materials (AI fBoM)
This provision directs the Secretary of Defense to update acquisition regulations to prohibit the DoD from entering into, renewing, or extending contracts for AI-enabled goods or services unless the contractor submits an AI fBoM to the Chief Digital and Artificial Intelligence Officer (CDAO) prior to contract action. Contractors must also be able to deliver an updated fBoM within 48 hours of a request.
Supporters argue
Proponents argue this is essential for national security, enabling the DoD to understand and manage risks associated with AI systems in its supply chain, and respond quickly to newly identified vulnerabilities.
Critics contend
Opponents might argue that this requirement could create significant administrative and technical burdens for contractors, potentially increasing costs and slowing down the procurement of advanced AI solutions.
Tradeoffs
The provision balances the critical need for enhanced security and transparency in AI procurement with the potential for increased compliance costs and administrative overhead for defense contractors.
Section 1(b)
Format and Contents of AI Functional Bill of Materials
This section specifies that the AI fBoM must be machine-readable and disclose sufficient detail to enable timely assessment of vulnerabilities, security risks, and integrity concerns. It outlines minimum requirements for the software, data, and hardware sections of the AI fBoM, ensuring comprehensive component disclosure.
Section 1(b)(2)
Minimum Requirements for Software Section of AI fBoM
This subsection mandates specific details for the software component of the AI fBoM. It requires descriptions of all AI models (pre-trained, fine-tuned, internally trained), including their names, versions, suppliers, origins, lineage, licenses, and integrity references. It also demands details on machine-learning frameworks, third-party packages, runtime dependencies, security controls, access history, and performance metrics.
Section 1(b)(3)
Minimum Requirements for Data Section of AI fBoM
This subsection outlines the data-related information required in the AI fBoM. It includes details on training data (origin, licensing, preprocessing), inference-time data sources, data storage systems, and metadata like names, versions, licenses, and unique identifiers. For each dataset, specific attributes such as sensitivity, supplier, creator, origin, lineage, country of origin, and processing history are required.
Section 1(b)(4)
Minimum Requirements for Hardware Section of AI fBoM
This subsection specifies the hardware information to be included in the AI fBoM. It requires details on compute resources (graphics processing units, tensor processing units), storage and networking infrastructure, and cloud environments (accounts, regions, and deployment boundaries) that support the artificial intelligence system.
Section 1(c)
Applicability of Software Bill of Materials (SBoM) Requirements to AI
This provision directs the Secretary of Defense to develop regulations and policies within 180 days to ensure that existing SBoM requirements also apply to the software components underpinning AI systems used or procured by the DoD. It also mandates a report within one year on implementation status, challenges, and the feasibility of updating relevant DoD instructions and statutes to include AI SBoM and more detailed SBoM for various technologies.
Section 1(d)
Cybersecurity Considerations for Bill of Materials Storage
This provision requires the Director of the Defense Systems Agency and Chief Information Officer to issue guidance within 180 days to procuring agencies on securely storing AI fBoMs. The guidance must include strict access controls, digital signing and hashing, secure sharing mechanisms, and centralized repositories to prevent tampering and unauthorized access.
Requires contractors to disclose the 'model origin' and 'model lineage' for all AI models, including pre-trained foundation models, fine-tuned models, and internally trained models.
Section 1(b)(2)(A)(v)(VI) and (V)
Why it matters:This level of detail is technically necessary for full transparency and risk assessment but can be challenging for contractors to provide, especially for models built on complex, multi-source foundations. Its placement is standard for detailed technical specifications.
Case for: Proponents argue that understanding the full lineage and origin of an AI model is critical for identifying potential biases, intellectual property risks, and supply chain vulnerabilities, especially for foundation models that might originate from various sources or jurisdictions.
Case against: Opponents might argue that tracing the full lineage of complex, open-source, or commercially pre-trained models can be extremely difficult, if not impossible, and could impose an undue burden on contractors, potentially revealing proprietary development methodologies.
Estimated impact: Significant impact on AI development and documentation practices for defense contractors, potentially increasing compliance costs and requiring new tracking systems.
Requires contractors to disclose the 'country of origin' for each dataset used in training or inference for AI systems.
Section 1(b)(3)(E)(xi)
Why it matters:This detail is crucial for national security considerations related to data sovereignty and potential foreign influence or access, but its technical nature places it within the specific data requirements.
Case for: Proponents argue that knowing the country of origin for data is essential for assessing geopolitical risks, compliance with data privacy laws, and identifying potential sources of adversarial data manipulation or espionage.
Case against: Opponents might argue that determining the precise country of origin for all data, especially for large, globally sourced datasets, can be technically challenging and resource-intensive, potentially leading to incomplete or inaccurate reporting.
Estimated impact: Significant impact on data management and documentation for contractors, requiring robust data provenance tracking.