Global Cyber Agencies Issue New SBOMs for AI Guidance

https://www.infosecurity-magazine.com/news/new-sboms-for-ai-guidance-2026/

Publish Date: 2026-05-27 01:48:36

Source Domain: www.infosecurity-magazine.com

Summary:
Multiple government cyber agencies have collaborated to issue new guidance defining the foundational elements for Software Bills of Materials (SBOMs) for Artificial Intelligence (AI) systems to enhance transparency and cybersecurity in AI supply chains. Published on 12 May by the G7 Cybersecurity Working Group, the paper “Software Bill of Materials (SBOM) for Artificial Intelligence – Minimum Elements” focuses on seven essential clusters that encapsulate critical information for AI systems. These clusters include metadata, system-level properties, models, dataset properties, key performance indicators, infrastructure, and security properties. While these clusters offer guidance for producers and users of AI systems, the document explicitly mentions that they are voluntary and open to further refinement. The paper also underscores that standing alone, SBOMs for AI are insufficient for robust cybersecurity; they need to be used in conjunction with cybersecurity tools such as vulnerability management and adaptive security measures. This guidance was jointly published by several major global cybersecurity organizations, including the US CISA, the UK’s NCSC, and the EU Commission.

Key Points:

The G7 Cybersecurity Working Group developed essential clusters for defining SBOMs for AI, aiming to improve transparency and security in AI supply chains.
The document outlines seven major clusters: Metadata, System Level Properties, Models, Dataset Properties, Key Performance Indicators, Infrastructure, and Security Properties.
Although helpful, the clusters are not mandatory and open to refinement, as some elements may be challenging to define uniformly.
The SBOM alone is deemed insufficient for cybersecurity; it should be paired with complementary cybersecurity tools to enhance AI supply chain security.
The guidance was collaboratively published by multiple leading cybersecurity agencies from around the globe.