,,ii #aaith ,,congress #b;d ,session ,s4 #ecde ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,august #f1 #bjbf,ms4 ,slotkin introduced the following bill2 which was read twice and referred to the ,committee on ,armed ,services ,a ,,bill ,to provide for the delivery of artificial intelligence functional bills of materials1 and for other purposes4 #a4 ,artificial intelligence functional bill of materials 7a7 ,artificial intelligence functional bill of materials ,the ,secretary of ,defense1 in coordination with the ,under ,secretary of ,defense for ,research and ,engineering1 the ,under ,secretary of ,defense for ,acquisition and ,sustainment1 the ,chief ,digital and ,artificial ,intelligence ,officer1 and the ,chief ,information ,officer shall revise the ,defense ,federal ,acquisition ,regulation ,supplement to prohibit the ,department of ,defense from entering into1 renewing1 or extending a contract for the procurement of goods or services that utilize artificial intelligence1 unless the contractor-- 7#a7 submits to the ,chief ,digital and ,artificial ,intelligence ,officer an artificial intelligence functional bill of materials prior to the award1 renewal1 or extension of the contract2 and 7#b7 maintains the bill of materials such that the contractor can deliver an updated bill of materials to the relevant component of the ,department of ,defense within #dh hours of a request for such bill of materials4 7b7 ,format and ,contents of ,artificial ,intelligence ,functional ,bill of ,materials 7#a7 ,in general ,a functional bill of materials described under subsection 7a7 shall-- 7,a7 include details related to the software1 data1 and hardware underpinning systems utilizing artificial intelligence in accordance with paragraphs 7#b71 7#c7 and 7#d7 of this subsection4 7,b7 be machine-readable2 and 7,c7 disclose sufficient detail to enable a timely assessment by the ,department of ,defense of the impact of-- 7i7 newly identified vulnerabilities2 7ii7 security risks2 7iii7 integrity concerns affecting software1 models1 or data2 and 7iv7 other newly available risk-relevant information affecting components incorporated into or relied upon by the artificial intelligence system4 7#b7 ,minimum requirements for software section of artificial intelligence functional bill of materials ,the software section of the artificial intelligence functional bill of materials required under subsection 7a7 shall include the following minimum elements3 7,a7 ,a description of all models of the artificial intelligence1 including-- 7i7 pre-trained foundation models2 7ii7 fine-tuned models customized for specific ,department of ,defense use cases through transfer learning or additional training2 7iii7 internally trained models1 including custom architectures and algorithms for the ,department of ,defense2 7iv7 other model versions and configurations deployed in production1 along with their hyperparameters and deployment context2 and 7v7 for each models described in clauses 7i7 through 7iv7-- 7,i7 the model name2 7,,ii7 the model identifiers2 7,,iii7 the model version or release identifier2 7,,iv7 the model supplier2 7,v7 the model origin2 7,,vi7 the model lineage2 7,,vii7 the model license2 7,,viii7 the integrity reference2 7,,ix7 a description of any self-hosted or custom models across containers or virtual machines2 7,x7 any model source registries and versions2 and 7,,xi7 a description of artificial intelligence agents and their functional boundaries 7abilities to read1 write1 and execute74 7,b7 ,a description of the dependencies of the artificial intelligence1 including-- 7i7 the machine-learning frameworks used to build and run the artificial intelligence2 7ii7 the developer-level artificial intelligence technologies and software development kits1 including integrated development environment extensions2 7iii7 any third-party packages1 including supporting libraries and open-source components that models of the artificial intelligence depend on2 7iv7 the runtime dependencies necessary for training1 serving1 or orchestrating artificial intelligence models in production2 and 7v7 any direct and nested transitive relationships4 7,c7 ,the security and governance of the artificial intelligence1 including-- 7i7 identity verification and access1 including service accounts1 roles1 permissions1 and credentials the artificial intelligence system uses2 7ii7 access paths1 including external application programming interfaces2 7iii7 security controls1 such as policies1 classifiers1 and validation mechanisms that apply to the artificial intelligence components2 7iv7 guardrail safety configurations and filters2 and 7v7 model context protocol server tool configurations4 7,d7 ,any access history and permissions granted by the artificial intelligence1 including-- 7i7 a description of the ownership of and access to the artificial intelligence system by the ,department of ,defense2 7ii7 the change history1 including audit trails that show who modified components1 when1 and why2 and 7iii7 a description of the approval workflows1 including processes that govern how artificial intelligence components move through development1 testing1 and production4 7,e7 ,the performance metrics and model updates1 including-- 7i7 use cases1 prioritizing high-impact use cases2 and 7ii7 performance metrics1 such as accuracy and latency4 7#c7 ,data section of artificial intelligence bill of materials ,the data section of the artificial intelligence functional bill of materials required under subsection 7a7 shall include the following minimum elements3 7,a7 ,the training data1 including datasets used to train or fine-tune models of the artificial intelligence1 including their origin1 licensing1 and any applied preprocessing4 7,b7 ,the inference-time data1 such as data sources any model of the artificial intelligence accessed during production1 including real-time ,a,p,is1 feature stores1 or data warehouses4 7,c7 ,data storage1 including the underlying storage systems1 such as cloud storage1 databases1 or vector databases1 that hold artificial intelligence-related data4 7,d7 ,metadata on components' name1 precise version1 file paths1 open-source licenses1 package managers1 and unique identifiers such as purl or cryptographic hashes4 7,e7 ,for each dataset described in subparagraphs 7,a7 through 7,d7-- 7i7 the dataset name2 7ii7 the dataset version or date of creation or last update1 whichever is more recent2 7iii7 the dataset location2 7iv7 the integrity reference2 7v7 the sensitivity of the data2 7vi7 the license to use such data2 7vii7 the data supplier2 7viii7 the creator of the data contained in the dataset2 7ix7 the data origin2 7x7 the data lineage2 7xi7 the country of origin2 and 7xii7 the data processing history4 7#d7 ,hardware section of artificial intelligence functional bill of materials ,the hardware section of the artificial intelligence functional bill of materials required under subsection 7a7 shall include relevant information of the physical infrastructure that the artificial intelligence runs on1 including the following minimum elements3 7,a7 ,compute resources1 including graphics processing units1 tensor processing units1 and other acceleration hardware artificial intelligence workloads use4 7,b7 ,any storage and networking that supports the artificial intelligence1 including the cloud infrastructure supporting artificial intelligence operations and other network paths between components4 7,c7 ,cloud environments1 including accounts1 regions1 and deployment boundaries on which artificial intelligence workloads run4 7c7 ,applicability of software bill of materials requirements to artificial intelligence 7#a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,secretary of ,defense1 in coordination with the ,under ,secretary of ,defense for ,research and ,engineering1 the ,under ,secretary of ,defense for ,acquisition and ,sustainment1 the ,chief ,digital and ,artificial ,intelligence ,officer1 and the ,chief ,information ,officer shall develop regulations1 guidance1 and policies to ensure that current policies1 regulations1 and guidance relating to the use1 submission1 or maintenance of a software bill of materials shall apply to the software that underpins artificial intelligence systems used1 developed1 or procured by the ,department of ,defense4 7#b7 ,report ,not later than one year after the date of the enactment of this ,act1 the ,secretary of ,defense shall submit to the ,committee on ,armed ,services of the ,senate and the ,committee on ,armed ,services of the ,house of ,representatives a report on-- 7,a7 the status of the implementation of the regulations1 guidance1 and policies developed under paragraph 7#a71 including any challenges1 recommendations1 and legislative or regulatory action needed to enhance the effectiveness of such implementation2 7,b7 the feasibility and necessity of updating ,department of ,defense ,instruction #ejjj4hg1 ,operation of the ,software ,acquisition ,pathway 7,october #b1 #bjbj7 and the software acquisition pathway established under section #cfjc of title #aj1 ,united ,states ,code1 with requirements for-- 7i7 an artificial intelligence software bill of materials2 and 7ii7 a more detailed software bill of materials in the procurement of software1 hardware1 artificial intelligence technologies1 and cryptographic technologies2 and 7,c7 the estimated costs of implementing the requirements described in subparagraph 7,b74 7d7 ,cybersecurity considerations for bill of materials 7#a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,director of the ,defense ,systems ,agency and ,chief ,information ,officer shall issue guidance on to procuring agencies on appropriate storage of any bill of material submitted under subsection 7a7 to align with the cybersecurity requirements of the ,department of ,defense4 7#b7 ,contents ,the guidance issued under paragraph 7#a7 shall include-- 7,a7 strict access controls2 7,b7 digital signing and hashing2 7,c7 secure sharing mechanisms2 and 7,d7 centralized repositories to prevent tampering and unauthorized access4 7e7 ,definitions ,in this section3 7#a7 ,artificial intelligence ,the terms artificial intelligence have the meanings given such terms1 respectively1 in section #ejja of the ,national ,artificial ,intelligence ,initiative ,act of #bjbj 7#ae ,u4,s4,c4 #idja74 7#b7 ,software bill of materials ,the term software bill of materials means the records kept in the normal course of business that identify each component1 library1 and dependency comprising a software application4