Software bill of materials for AI - minimum elements

A software bill of materials (SBOM) acts as an “ingredients list” for software that better positions organizations to understand their supply chains and make risk-informed decisions about how to protect their critical systems.

The guidance builds on CISA’s previous work with federal and international partners to establish a shared vision for a software bill of materials and provides recommendations on minimum elements that should be included in an SBOM for AI.

Because AI systems are software systems, these recommendations should be considered in addition to the general minimum elements for an SBOM.