DoD 3000.09 compliance checklist for autonomy vendors

The explainer is Autonomy and DoD Directive 3000.09 explained. This page is the vendor checklist. Items below quote the 25 January 2023 directive (also on media.defense.gov). Completing the CDAO AIA / RAI Toolkit is a voluntary process; it is not a 3000.09 review.

1. Is this even a 3000.09 system?

Ask first. The directive does not apply to the autonomous or semi-autonomous operation of unarmed platforms or to autonomous or semi-autonomous systems that are not weapon systems. Do not treat every DoD AI sale as a 3000.09 system. See the 3000.09 explainer.

2. Human judgment over the use of force

If it is a covered weapon system, autonomous and semi-autonomous weapon systems will be designed to allow commanders and operators to exercise appropriate levels of human judgment over the use of force. A vendor packet that only shows model accuracy is not that sentence. Related human-machine-teaming pages: Human-machine teaming requirements.

3. V&V and realistic T&E

The directive requires rigorous hardware and software verification and validation and realistic system developmental and operational test and evaluation. Ask for the V&V plan, the developmental T&E record and the operational T&E record — named as such.

JATIC develops software products for AI Test & Evaluation (T&E) and AI Assurance. The FAQ says use of those products will not currently provide any certification or accreditation but may help provide the necessary documentation required for certain DoD processes such as DoD Directive 3000.09. The CDAO T&E of AI Models Framework names AI Model T&E, Systems Integration (SI) T&E, Human Systems Integration (HSI) T&E and Operational T&E (OT&E). See CDAO test and evaluation of AI systems.

4. Senior review, not a vendor stamp

3000.09 establishes senior-review paths for certain autonomous and semi-autonomous weapon systems. A vendor cannot self-certify that review. Ask which review path the program office expects and what artifacts they will accept from you. Do not advertise “3000.09 certified.”

5. Do not confuse 3000.09 with RAI or CMMC

The five DoD AI ethical principles apply to how Department personnel develop, deploy, and use AI capabilities. They are broader than weapon-system autonomy. CMMC is about CUI on contractor information systems. Completing the RAI Toolkit identifies, tracks, and improves alignment of AI projects to RAI best practices and the DoD AI Ethical Principles. That is not the 3000.09 senior review.

Questions

If our platform is unarmed, do we still need a 3000.09 package?

The directive does not apply to the autonomous or semi-autonomous operation of unarmed platforms. Whether a specific product is unarmed or “not a weapon system” is a program-office determination.

Does a JATIC library satisfy 3000.09 T&E?

The JATIC FAQ says the products may help provide the necessary documentation required for certain DoD processes such as DoD Directive 3000.09 and will not currently provide any certification or accreditation.