The AI functional bill of materials bill (S.5345) — imposing disclosure of what is inside an AI through procurement rather than regulation, with 48-hour updates
A bill amending the Defense Federal Acquisition Regulation Supplement so that the Department of Defense may not enter into, renew or extend a contract for goods or services using artificial intelligence unless the contractor submits an AI functional bill of materials. The contractor must also keep it current enough to deliver an updated version within 48 hours of a request.
Bill overview (primary data)
- Bill numberS. 5345
- TypeSenate Bill
- Congress119th Congress
- Latest actionRead twice and referred to the Committee on Armed Services.（2026-08-06）
Key points
- A bill amending the Defense Federal Acquisition Regulation Supplement so that no contract for AI-using goods or services may be entered into, renewed or extended unless the contractor submits an AI functional bill of materials.
- The bill of materials goes to the Chief Digital and Artificial Intelligence Officer prior to award, renewal or extension.
- The contractor must maintain it so an updated version can be delivered within 48 hours of a request.
- Its scope reaches beyond software to the data and hardware underpinning systems that use AI.
- It must be machine-readable and disclose enough detail for timely assessment of new vulnerabilities, security risks and integrity concerns.
- The bill of materials is not a one-off at award; the ability to produce an update within 48 hours must be maintained.
1Not regulation but declining to buy
This bill forbids neither the development nor the use of AI. What it amends is the Defense Federal Acquisition Regulation Supplement, taking the form of not contracting with anyone who fails to meet a condition. In a field where the government is the largest buyer, procurement conditions operate as a de facto standard.
Placing a condition at the entrance to a contract moves faster on existing machinery than erecting prohibitions and penalties. Among the bills this site holds are ones that require reports, ones that require disclosure and ones that prohibit; this belongs to the type imposed as a condition of purchase.
2Reaching data and hardware, not only software
The phrase bill of materials descends from the SBOM idea of listing the components of software. What this bill requires is wider: details of the software, data and hardware underpinning systems that use AI. How an AI behaves turns not only on code but on what it learned from and what it runs on.
That integrity concerns affecting software, models and data appear alongside vulnerabilities and security risks reads as an attempt to view all three as one object.
3What the 48 hours signify
Submission is not a one-time event at contracting. The contractor must keep the bill of materials in a state where an updated version can be produced within 48 hours of a request. That is a requirement to hold it as a mechanism kept current, not to produce a document once.
Matching which system under which contract is affected when a new vulnerability surfaces, in a short window, needs the artifact to be both machine-readable and up to date. Machine-readable is written into the text because the intended use is matching rather than human reading.
4Not a document to produce, but a capability to hold
The bill of materials this bill requires is not something submitted once at contract award. Maintaining the ability to produce an updated version within 48 hours of a request is written in.
- 1Submit at contractInclude detail of the software, data and hardware supporting the AI-enabled system
- 2Keep it currentMaintain the ability to produce an updated version within 48 hours of a request
- 3Hold it machine-readableThe premise is use for matching rather than for a person to read
- 4Match against impactWhen a new vulnerability appears, identify quickly which system under which contract is affected
The amendment targets the Defense Federal Acquisition Regulation Supplement, taking the form of not contracting with those who do not meet the condition. Where government is the largest buyer, a procurement condition works as a de facto standard. The term bill of materials comes from SBOM, and the scope here is wider, reflecting that AI behaviour turns not only on code but on what it learned from and what it runs on.
Why it matters
Where government is a major buyer, procurement conditions function as a de facto industry standard. Keeping AI components machine-readable and continuously current is not something assembled per contract; it has to sit inside the development process. That data and hardware fall within scope means the effect reaches suppliers upstream, not only model providers.
FAQ
What is an AI functional bill of materials?
Why 48 hours?
Does the bill prohibit using AI?
Sources (primary)
Source: Congress.gov (Library of Congress; U.S. legislative materials, public domain). Links go to the official site.
- Congress.gov (bill page, original)
- S. 5345（119th Congress）