A bill to provide for the delivery of artificial intelligence functional bills of materials, and for other purposes.

This bill requires the Department of Defense (DoD) to mandate that contractors submit an Artificial Intelligence Functional Bill of Materials (AI SBOM) for any contract involving artificial intelligence (AI) goods or services. Contractors must provide this AI SBOM before a contract is awarded, renewed, or extended, and must be able to deliver updated versions within 48 hours of a request. The primary goal is to enhance the DoD's ability to assess vulnerabilities, security risks, and integrity concerns within AI systems. The AI SBOM must be machine-readable and disclose comprehensive details across three main categories: software, data, and hardware . The software section requires information on AI models, their dependencies, security controls, access history, and performance metrics. The data section mandates details on training data, inference-time data, data storage, and metadata, including origin, licensing, and lineage for each dataset. Finally, the hardware section covers compute resources, storage, networking, and cloud environments supporting the AI. Furthermore, the bill directs the Secretary of Defense to develop regulations within 180 days to ensure that existing policies and guidance for software bills of materials (SBOMs) are applied to the software components of AI systems used or procured by the DoD. It also mandates a report within one year on the implementation status, challenges, and the feasibility of updating DoD acquisition pathways to include AI SBOM requirements. Additionally, guidance must be issued within 180 days on the secure storage of these AI SBOMs, emphasizing strict access controls, digital signing, and centralized repositories to prevent tampering.