Software supply-chain assurance in defence and government work has settled around a small set of artefacts: a secure development attestation, a software bill of materials, and evidence that you follow a recognised secure development framework. Each of them has a blind spot in the same place.
An SBOM stops at the boundary of your own code
A bill of materials enumerates the third-party components in a build: names, versions, licences, known vulnerabilities. It is genuinely useful and it answers a question nobody was asking about AI, because it describes what you included, not how you wrote what you included it into.
The first-party source — the part a coding agent may have drafted a large share of — appears in an SBOM as a single entry, if at all.
The framework language already reaches it
NIST's Secure Software Development Framework (SP 800-218) asks producers to archive and protect each software release, to document the provenance of the code they ship, and to make that information available to acquirers. Its generative-AI companion profile extends the same practices to software produced with AI assistance rather than creating a separate regime.
Read plainly, “document the provenance of your code” includes the code a model wrote. Most producers currently cannot, and the attestation does not yet force the issue.
Why classification makes it harder, not easier
Air-gapped and accredited environments are precisely where a recorder that phones home is unacceptable, and precisely where the provenance question is asked most sharply. Any answer here has to work with capture written to local storage inside the boundary, export under the operator's control, and no dependency on an external service being reachable — or it will not be permitted at all.
What an acquirer can reasonably ask for today
Not a certificate. A description: which AI coding tools are permitted on the programme, what is recorded when they are used, how long the record is retained, how it is verified against tampering, and which parts of the codebase predate the recording. Every item on that list is answerable now by a supplier who decided to answer it, and by no supplier who did not.