On 12 May 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) and partners released joint guidance on the minimum elements of a software bill of materials (SBOM) for AI systems. The partners came from Germany, Canada, France, Italy, Japan, the United Kingdom and the European Union.[1] An SBOM is an inventory of the components in a piece of software. CISA likens it to an ingredients list.[1]

The Cybersecurity Working Group of the Group of Seven (G7) wrote the guidance. The guidance groups its elements into seven clusters: metadata about the SBOM itself, system-level properties, models, datasets, infrastructure, security properties and key performance indicators.[2]

For each model, an SBOM for AI should record a hash of the weights or model file (a fingerprint computed from its contents) and the hash algorithm. With these values, the component's integrity can be validated. If the SBOM's author has no access to the model artifact, the value should be marked unknown.[2] Each dataset gets its own hash and a provenance element describing its sources, collection methods and processing steps. The metadata cluster includes a digital signature attributable to the SBOM's author.[2]

CISA says the elements are neither exhaustive nor mandatory. It adds that they reflect the consensus of G7 experts and will expand over time. Because AI systems are software systems, CISA says, the elements should be considered in addition to the general minimum elements for an SBOM.[1] CISA and partners updated those general elements on 29 July, replacing the list that the National Telecommunications and Information Administration published in 2021. They noted that AI software may require additional elements.[3]

Sources

  1. CISA & G7 Partners Release Joint Guidance on the Minimum Elements of a Software Bill of Materials for Artificial IntelligenceCybersecurity and Infrastructure Security Agency · 12 May 2026
  2. Software Bill of Materials for AI: Minimum ElementsG7 Cybersecurity Working Group, via BSI · 12 May 2026
  3. 2026 Minimum Elements for a Software Bill of Materials (SBOM)Cybersecurity and Infrastructure Security Agency · 29 Jul 2026

Check or correct this page

Correct
Request a correction · Edit the source on GitHub · Corrections policy
Verification record

The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.

7a6fd6d94b18c715257289b90b05b19c74aea6cf914d6d51ff4ffeb5a6ff4ca4

View source · Manifest