SCITT and AI Supply Chain Transparency: Why the IETF Standard Changes AI Procurement

SCITT — Supply Chain Integrity, Transparency, and Trust — is an IETF working group standardising how supply chain claims are registered, verifiable, and auditable across organisational boundaries. The architecture is simple and powerful: an issuer makes a claim about an artifact (e.g. 'this model was trained on dataset D, fine-tuned with method M, and measured at governance 0.27'), registers that claim in a transparency ledger, and any verifier can check it without trusting the issuer's own database. For AI procurement, SCITT solves the 'who do you trust?' problem.

Today, a vendor says their model passed a safety audit — but the audit report lives on the vendor's website, and the auditor's signature is a PDF. A SCITT-registered claim is different: the measurement credential (a signed JSON object, per the Council of AI verified measurement credential standard) is registered in a transparency service, the claim is independently auditable, and the registration is tamper-evident. The EU AI Act (Regulation 2024/1689) requires technical documentation demonstrating compliance (Art. 11); the US Executive Order 14110 mandates software bills of materials for high-risk AI; the UK Cyber Security and Resilience Bill imposes supply chain security duties.

All three point toward the same architecture: signed claims, registered transparently, verifiable offline. SCITT is the IETF standard for that architecture. The Council of AI integrates SCITT into its measurement pipeline: every per-axis board card can be registered as a SCITT claim, every verified measurement credential can carry a SCITT receipt, and every containment incident can be appended to a transparency ledger that regulators and purchasers query directly.

The procurement question shifts from 'Trust us, we tested it' to 'Here is the SCITT-registered claim — verify it yourself.'

Standards and sources referenced

  • IETF SCITT WG — RFC 9485 (CO SE), draft-ietf-scitt-architecture
  • EU AI Act (Regulation 2024/1689), Art. 11 technical documentation
  • US Executive Order 14110 — Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence
  • UK Cyber Security and Resilience Bill — AI supply chain obligations
  • Council of AI Verified Measurement Credential standard (DEFONEOS-SEAL)
  • CSOAI sign.py — Ed25519 signature layer (SCITT-compatible claim format)