What JSP 936 Part 1 asks of industry partners and suppliers

The comparison page UK MOD JSP 936 vs DoD Responsible AI is the UK/US side-by-side. This page is what JSP 936 Part 1 actually says to a supplier or industry partner. Official UK pages still say Artificial Intelligence and AI. This article uses those names. Super Intelligence (SI) is this site’s own-voice term for current U.S. executive-branch policy; it does not rewrite JSP 936.

Who the directive binds

GOV.UK calls Part 1 the principal policy framework governing the safe and responsible adoption of AI in MOD, published 13 November 2024. It follows the Defence Artificial Intelligence Strategy and the Ambitious, Safe, Responsible policy. The V1.1 PDF mandates the application of ambitious, safe and responsible practices relating to all Defence projects that include Artificial Intelligence (AI). It is designed to be used by MOD staff responsible for developing and/or using systems which include AI, regardless of the application domain.

The same PDF is explicit about the audience inside MOD: This JSP must be applied by all MOD staff in all phases of the system life cycle, from pre-concept through to equipment disposal / service termination.

GOV.UK separately addresses industry: By reading and understanding JSP 936 part 1, our industry partners can ensure that their projects are aligned with defence’s strategic goals, expectations on ethical AI, and technical requirements. The cover note says Delivering ambitious, safe and responsible AI-enabled capability is therefore a shared endeavour between MOD and its suppliers. Later: Meeting the JSP requirements should be a shared endeavour between MOD and its suppliers.

Those two sentences are the sourced industry role: read Part 1, align the project, share the endeavour. The must that names “all MOD staff” is not rewritten as a supplier certification scheme. See the UK MOD JSP 936 explainer.

Must, should, new work and legacy AI

The PDF defines the verbs:

• Must means the action is a compulsory requirement to be completed by the actioner.
• Should means the action is not a compulsory requirement but is recommended good practice and therefore should be considered and applied as far as possible in the relevant context.

On timing: The requirements set out in this JSP must be implemented from the outset of all Defence Capability development where MOD requirements lead to the use of AI. For systems already in service: For legacy AI that is still running or being repurposed, alignment with the requirements of the JSP should be achieved in so far as is possible. Where that is not possible, tailoring of the JSP must be applied and an assessment of risk must be undertaken.

The cover note is also blunt that the document is an aiming point: Where we cannot yet fully meet the JSP requirements, we should understand the risk and plan a route to compliance.

What Part 1 tells industry in its own words

Several must / should lines name developers, products or suppliers directly:

• Legal advice: Industry and developers will need to obtain their own legal advice as to the legal framework that applies to their development of the product, including in respect to the use of data and intellectual property. MOD staff must seek legal advice through existing channels; that sentence is not a substitute for the industry one.
• Labelling: All digital systems containing AI that are within scope of this JSP must be clearly identified as such (i.e. as AI-based). Products (such as documents, images etc.) that have had AI applied in their development must clearly state that AI has been used in their production.
• Civil standards: programmes should adopt civil standards where possible to achieve recognised good practice; however, these should be assessed for applicability.
• Proportion: The application of this JSP should be proportionate to the maturity and nature of the AI application.

The five principles the JSP copies verbatim from the ASR policy are Human-centricity, Responsibility, Understanding, Bias and harm mitigation, and Reliability. Organisations must consider these principles as early as practicable.

Part 2 and the AI Practitioner’s Handbook

The JSP is two parts. Part 1 - Directive provides the direction that must be followed. Part 2 - Guidance provides the guidance and best practice that will assist the user to comply with the Directive(s) detailed in Part 1.

MOD’s AI Practitioners’ Hub is a site for JSP 936 Part 2 guidance and resources. It provides guidance and resources to help you comply with the policy and requirements outlined in JSP 936 Part 1. Before using it, you should have an understanding of JSP 936 Part 1 first.

The AIPH sign-off page tells suppliers what they can usefully do without pretending they are the Senior Responsible Officer: If you’re building an AI system for MOD, you can support the MOD team by understanding relevant policies. The MOD team still has to confirm that the system follows JSP 936 directives during development of the AI system and in its final design and that the SRO is satisfied with the level of risk before deployment.

The directory lists the AI Practitioner’s Handbook as that official Part 2-style resource. It is not a substitute for the directive.

What Part 1 is not

JSP 936 does not provide a list of AI-enabled systems or capabilities which are compliant or not compliant. It is not a CMMC level, not a DoD RAI Toolkit completion, and not an aviation means of compliance. Completing the US AIA Toolkit does not satisfy JSP 936 on any page we cite.

Questions

Does reading JSP 936 make a supplier “JSP 936 certified”?

No source we cite uses that phrase. Part 1 must be applied by all MOD staff. Industry partners are told to read and understand it so projects align. Sign-off stays with the MOD SRO on the AIPH page.

Does the AI Practitioner’s Handbook replace Part 1?

No. The Hub helps you comply with … JSP 936 Part 1 and tells you to understand Part 1 first. Part 2 is guidance and best practice, not the directive.

Is legacy in-service AI exempt?

No. Alignment should be achieved in so far as is possible. Where it is not, tailoring … must be applied with a risk assessment.