G7 Countries Release AI SBOM Guidance
G7 Countries Release AI SBOM Guidance
https://www.securityweek.com/g7-countries-release-ai-sbom-guidance/
Publish Date: 2026-05-14 07:15:00
Source Domain: www.securityweek.com
Government agencies from Group of Seven (G7) countries this week published joint guidance to help organizations create a software bill of materials (SBOM) for AI.
An SBOM is a detailed, machine-readable manifest that catalogs every component, library, dependency, and module incorporated into a software product to provide full transparency into its composition.
Government agencies have been working on updated SBOM guidance and they have been pushing for the widespread adoption of SBOMs to bolster cybersecurity.
Agencies in the United States, Canada, Japan, Germany, France, Italy, the United Kingdom, and the European Union have now published SBOM guidance focusing on AI.
The newly released document, named ‘Software Bill of Materials for AI – Minimum Elements’, aims to help public and private sector organizations enhance transparency in their AI systems and supply chains.
According to its authors, it provides actionable guidelines for AI developers and deployers, making it easier to track vulnerabilities and reduce risks.
The document outlines seven main clusters that should be present in an SBOM for AI: metadata, models, key performance indicators (KPI), infrastructure, security properties (SP), system level properties (SLP), and dataset properties (DP).
The metadata cluster should include elements about the SBOM itself, including its author, version, data format, author signature, tool name and version, generation context, timestamp, and dependency relationship.
The SLP cluster should contain information about the AI system, including name, producer, version, components, timestamp, data flow and usage, input/output properties, and intended application area.
The guidance recommends creating a models cluster that contains information about the models used by the AI, including name, identifier, version, producer, description, timestamp, hash value and algorithm, properties, license, and…
