Kurtzer proposes AI bill of materials to manage enterprise legal risk
Greg Kurtzer advocates for an AI bill of materials to help organizations validate model contents and manage liability. He argues that human accountability is essential because AI entities cannot be held legally responsible for their actions.
Greg Kurtzer has proposed the adoption of an AI bill of materials (AI BOM) as a critical tool for enterprises and federal agencies to manage compliance and liability risks in artificial intelligence usage. Kurtzer contends that AI entities cannot be held responsible for their actions, meaning accountability must remain with humans, specifically the prompters or trainers. For large organizations, using models without knowing their training data creates unmanageable risk; an AI BOM would allow these entities to conduct risk inventories and validate the contents of the model. While vendors may resist providing this transparency, Kurtzer argues it is necessary for trust.
Kurtzer also highlights specific legal uncertainties that necessitate clear ownership and oversight of AI actions. He points out that the Computer Fraud and Abuse Act (CFAA) has no carve-out for AI, meaning humans will ultimately be liable for damages caused by AI agents, such as unauthorized access or hacking. Additionally, he questions whether models trained on copyleft code, such as GPL or GNU, become derivative works subject to the same license, a matter that has not yet been litigated. Kurtzer maintains that because AI cannot be responsible for its decisions, it should not be alone making them, and human oversight is required to mitigate these legal exposures.