The document summarizes discussions from an OpenChain AI Study Group meeting on anti-trust policy and building trust in the open source AI supply chain. It recaps previous discussions, defines the scope as establishing how to ensure "compliance artifacts" like data cards and model cards can be trusted throughout the supply chain. It also lists AI regulatory frameworks and discusses using cases like delivering pre-trained models or datasets. The appendix section asks for any other business and recaps goals of establishing industry agreements on AI management and developing principles for transparency and bias.

1. OpenChain AI Study
Group
2024-02-06

2. Anti-Trust Policy Notice
● Linux Foundation meetings involve participation by industry competitors, and it is the
intention of the Linux Foundation to conduct all of its activities in accordance with
applicable antitrust and competition laws. It is therefore extremely important that
attendees adhere to meeting agendas, and be aware of, and not participate in, any
activities that are prohibited under applicable US state, federal or foreign antitrust and
competition laws.
● Examples of types of actions that are prohibited at Linux Foundation meetings and in
connection with Linux Foundation activities are described in the Linux Foundation
Antitrust Policy available at http://www.linuxfoundation.org/antitrust-policy. If you have
questions about these matters, please contact your company counsel, or if you are a
member of the Linux Foundation, feel free to contact Andrew Updegrove of the firm of
Gesmer Updegrove LLP, which provides legal counsel to the Linux Foundation.

3. Agenda
1. Recap of discussion so far
2. Scope – how to build trust in the open source AI supply chain
○ What are the “compliance artifacts”?
○ How do we know they can be trusted?
3. Discuss use cases
○ Inbound
○ Deployment internally
○ Hosting externally
○ Distributing externally

4. Agenda 6th Feb 2024
OpenChain AI study
group
1) Recap of discussion so far
2) Scope – how to build trust
in the open source AI
supply chain
1) What are the “compliance artifacts”?
2) How do we know they can be trusted?
3) Discuss use cases
1) Inbound
2) Deployment internally
3) Hosting externally
4) Distributing externally

5. New Era, but Same Solution
5
outbound
upstream downstream
inbound Training
Policy
Process
Goal: Compliance Artifacts delivered by a consistent process so
that it can be relied upon throughout the supply chain

6. The AI
Regulatory
Framework
● EU AI Act
● China’s
○ Generative AI Measures
○ Deep Synthesis Provisions
○ Algorithm Recommendation Provisions
○ Security Assessment Provisions
○ CAC Testing Requirements
● US
○ Executive Order on AI
○ Blueprint for AI Bill of Rights
● OECD Guidelines for Secure AI system
Development
● […]
Compare: NIST AI Risk Management Framework:

7. Use Cases for Data + Models
7
Dataset
Data
source 1
Data
source n
...
Training Inference
Deployed Environment
AI Model
User
Prompt Response
Back Propagation
Delivery of pre-
trained model
• The AI Model
equivalent to an
attribution file and
a readme
• Not the same
Brownian Motion
problem
• More interesting
licenses Data Card
Model
Card

8. Any Other Business?

9. Appendix

10. Goals for AI Study
Group
● Establishing industry-wide
agreement on AI management
● Developing AI principles for building
trust in supply chain
● Discussing AI ethics such as
transparency and bias
DISCUSSION – do you agree? What are
your thoughts?
From Jan 23, 2024 Meeting:

11. Achieving Our Goals
● Weekly meet up to discuss
progress
● Commitment for progress
DISCUSSION : what else do we need to
meet our goals?
From Jan 23, 2024 Meeting: