May 15, 2025
Ms. Warren (for herself and Mr. Schmitt) introduced the following bill; which was read twice and referred to the Committee on Armed Services
To provide for certain requirements relating to cloud, data infrastructure, and foundation model procurement.
Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,
Section 1. Short title
This Act may be cited as the Protecting AI and Cloud Competition in Defense Act of 2025
.
Sec. 2. Ensuring competition in artificial intelligence procurement
(a) Definitions
In this section:
(1) Artificial intelligence; AI
The terms artificial intelligence and AI have the meaning given the term artificial intelligence in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).
(2) Cloud computing
The term cloud computing has the meaning given the term in Special Publication 800–145 of the National Institute of Standards and Technology, or any successor document.
(3) Cloud provider
The term cloud provider means any company engaged in the provision, sale, or licensing of cloud computing to customers, including individuals and businesses.
(4) Congressional defense committees
The term congressional defense committees has the meaning given the term in section 101(a) of title 10, United States Code.
(5) Covered provider
The term covered provider means any cloud provider, data infrastructure provider, or foundation model provider that has entered into contracts with the Department of Defense totaling at least $50,000,000 in any of the 5 previous fiscal years.
(6) Data infrastructure
The term data infrastructure means the underlying computer, network, and software systems that enable the collection, storage, processing, and analysis of data, including the ability to record, transmit, transform, categorize, integrate, and otherwise process data generated by digital data systems.
(7) Data infrastructure provider
The term data infrastructure provider means any company engaged in the provision, sale, or licensing of data infrastructure to customers, including individuals and businesses.
(8) Foundation model
The term foundation model means an artificial intelligence model that—
(A)
(i)
generally uses self-supervision;
(ii)
contains at least 1,000,000,000 parameters; and
(iii)
is applicable across a wide range of contexts; or
(B)
exhibits, or could be easily modified to exhibit, high levels of performance at tasks that pose a serious risk to security, national economic security, national public health, or safety.
(9) Foundation model provider
The term foundation model provider means any company engaged in the provision, sale, or licensing of foundation models to customers, including individuals and businesses.
(10) Multi-cloud technology
The term multi-cloud technology means architecture and services that allow for data, application, and program portability, usability, and interoperability between infrastructure, platforms, and hosted applications of multiple cloud providers and between public, private, and edge cloud environments in a manner that securely delivers operational and management consistency, comprehensive visibility, and resiliency.
(b) Cloud, data infrastructure, and foundation model procurement requirements
The Secretary of Defense shall, in contracting provisions with cloud providers, foundation model providers, and data infrastructure providers—
(1)
promote security, resiliency, and competition in the procurement of such solutions by requiring a competitive award process for each procurement of cloud computing, data infrastructure, or foundation model solutions;
(2)
ensure that the Government maintains exclusive rights to access and use of all Government data; and
(3)
ensure that the competitive process—
(A)
prioritizes the appropriate role for the Government with respect to intellectual property and data rights and security, interoperability, and auditability requirements;
(B)
includes modular open systems approaches and appropriate work allocation and technical boundaries;
(C)
mitigates barriers to entry faced by small businesses and nontraditional contractors; and
(D)
prioritizes multi-cloud technology unless doing so is infeasible or presents a substantial danger to national security.
(c) Data training and use protection
The Secretary of Defense shall direct the Chief Digital and Artificial Intelligence Office to update or promulgate provisions of the Defense Federal Acquisition Regulation Supplement (DFARS) to ensure that—
(1)
Government-furnished data, provided for purposes of development and operation of AI products and services to the Department of Defense, is not disclosed or used without proper authorization by the Department of Defense, including that such data cannot be used to train or improve the functionality of commercial products offered by a covered provider without express authorization by the Department of Defense;
(2)
Government-furnished data stored on vendor systems, provided for purposes of development and operation of AI products and services to the Department of Defense, is appropriately protected from other data on such systems, and is treated in accordance with Department of Defense data decrees and Creating Data Advantage (Open DAGIR) principles;
(3)
violation of these provisions shall be subject to specific penalties, including fines and contract termination; and
(4)
component acquisition executives may issue exemptions upon—
(A)
determining that issuing an exemption is necessary for national security; and
(B)
notifying the Chief Digital and Artificial Intelligence Officer of the specific provisions exempted, the vendor and program being issued the exemption, and the justification for the exemption.
(d) Reporting
(1) In general
Not later than January 15, 2027, and annually thereafter for four years, the Chairman of the Joint Chiefs of Staff, in coordination with the Under Secretary of Defense for Acquisition and Sustainment, shall submit to the congressional defense committees a report assessing the competition, innovation, barriers to entry, and concentrations of market power or market share in the AI space for each period covered by the report. The report shall also include a list of the exemptions granted under subsection (c)(4)(A), including the date and purpose of the exemption. The report shall also include recommendations of appropriate legislative and administrative action.
(2) Publication
The Secretary of Defense, acting through the Assistant to the Secretary of Defense for Public Affairs, shall ensure that the report is made available to the public by—
(A)
posting a publicly releasable version of the report on a website of the Department of Defense; and
(B)
upon request, transmitting the report by other means, as long as such transmission is at no cost to the Department.