The AI Bill of Materials Is the New SBOM, and Nobody Has to Publish One

On 12 May 2026 the G7 published minimum elements for an AI bill of materials. The guidance defines 7 clusters of disclosure covering models, datasets, infrastructure and security properties. It also states that none of it is mandatory. The AI bill of materials now has a shape, two working file formats, and no obligation attached to it anywhere outside Europe.

What an AI bill of materials actually lists

An AI bill of materials, usually written AIBOM or AI SBOM, is a machine-readable inventory of what sits inside an AI system. It names the models, the datasets behind them, the frameworks, the hosting and the controls.

The direct-answer version is short. An AIBOM tells a buyer which models a product calls, where the weights came from, what the models were trained on, what infrastructure runs them, and what security and performance testing was done. It is a supply chain disclosure for software whose behaviour is decided by data rather than only by code.

How it differs from a software bill of materials

A conventional SBOM lists packages and versions. Every entry is a file with a hash, and a scanner can check it against a vulnerability database.

An AI system breaks that model in three places. The weights are a large binary with no meaningful package version. The training data is usually described rather than enumerated. And the thing that changes your risk most often is a silent model update at the vendor, which no dependency file records.

So an AIBOM is not an SBOM with extra rows. It is an SBOM plus a set of claims about provenance, testing and change that only the supplier can make. That distinction shapes everything below.

Why the AIBOM arrived in 2026 rather than 2023

The idea is older than the current push. What changed is that two separate pressures arrived in the same year, one from attackers and one from regulators.

The registry problem

AI development runs on open registries, and those registries are now being farmed. Reporting in May 2026 collected the scale of it across the two largest ones.

Protect AI identified roughly 352,000 unsafe or suspicious issues across 51,700 Hugging Face models, and JFrog found more than 100 models capable of arbitrary code execution. On the agent skills side, Koi Security counted 341 malicious entries in a set of 2,857, per The Next Web's summary of the research.

Treat those counts as directional. They come from competing vendor scanners with different definitions of unsafe, and none of them is an audited figure. The pattern still holds, and it is the same pattern that produced the SBOM: you cannot triage a component you never recorded. The equivalent problem for agent tooling is covered in the piece on what an MCP server actually exposes when you install it.

The regulatory clock

The second pressure is a calendar. Three dates now sit inside 18 months of each other, and each one asks a supplier to write down what is inside a product.

Article 53 of the EU AI Act has required a public summary of training content from new general-purpose models since 2 August 2025. High-risk system obligations under Article 11 and Annex IV technical documentation applied from 2 August 2026. The EU Cyber Resilience Act adds a machine-readable SBOM requirement for products with digital elements from 11 December 2027.

The G7 published minimum elements, then declined to require them

CISA released Software Bill of Materials for AI: Minimum Elements with G7 partners on 12 May 2026. The co-sealing set was Canada, France, Germany, Italy, Japan, the United Kingdom and the European Union.

It is the closest thing the market has to an agreed definition. It is also, by its own wording, advisory.

The seven clusters

The guidance groups AIBOM content into seven clusters rather than a flat field list. That choice matters, because it lets each cluster be filled at whatever depth the supplier can actually support.

Cluster names and scope are taken from the CISA and G7 guidance as reported by Infosecurity Magazine, May 2026. The third column is our assessment, not part of the guidance.

Why voluntary was the only honest option

The document says the elements are not mandatory and do not create requirements, standards or legislation, as SecurityWeek recorded at publication. That reads like a hedge. It is closer to an accurate statement of what can be enforced today.

Allan Friedman, who led CISA's SBOM work before leaving the agency, put the problem precisely. He said he liked a lot of the clusters, and that many of them are hard to measure or even hard to define in a specific, cross-organization fashion, per Infosecurity Magazine's coverage.

That is the real constraint. You cannot mandate a field that two suppliers would fill differently and both be right. Dataset provenance and resistance to adversarial input are exactly that kind of field. Mandating them now would produce compliant documents that say nothing, which is worse than no document, because it converts an open question into a closed one.

The file formats are further along than the policy

Policy is behind. Tooling is not. Two mature formats can already carry most of what the seven clusters describe, and both predate the G7 guidance.

SPDX 3.0 added an AI profile and a Dataset profile. The working group behind them evaluated 103 candidate fields and kept 36: 20 in the AI profile with 5 required, and 18 in the Dataset profile with 6 required. That process ran across 82 meetings with 92 unique participants, according to the preprint written by the group that did it. It is a preprint rather than peer-reviewed work, and the authors were participants in the process they describe, so read the validation claims with that in mind.

CycloneDX takes the other approach with its ML-BOM, which sits inside a format already wired into build pipelines and vulnerability tooling. The two are not competitors in practice. Both are generated from the same underlying metadata, which means a supplier can emit both from one source of truth.

That gap is not academic. The EU template asks for a narrative summary of training content, and providers have answered it in different shapes. A review of published summaries found that several major providers replaced the template boxes with prose, which is permitted and which also makes comparison across providers effectively manual. If you are assembling that comparison yourself, the side-by-side of the major model provider terms covers the contractual half of the same question.

A 12-field disclosure template you can publish this quarter

Here is the proposal. Seven clusters is a taxonomy, not a document. What a buyer needs is a page a supplier can fill in an afternoon and update on release.

These 12 fields map onto the G7 clusters and onto the SPDX and CycloneDX profiles. They are deliberately fewer than either standard. A short disclosure that is kept current beats a complete one that ages out in a quarter.

This template is our own construction. The cluster column maps it to the CISA and G7 taxonomy so that a supplier already working toward that guidance is not asked to restructure anything.

The field most vendors will refuse

Field 12 is the one to fight for, and the one most suppliers will resist. Everything above it is a snapshot. Field 12 is the only entry that keeps the document true after signature.

Model versions change under managed APIs, sometimes without a version bump that reaches the buyer. An inventory taken at procurement and never refreshed describes a system that no longer exists. We would trade fields 4, 9 and 10 for a written change-notice commitment without hesitating.

Two fields also carry legal weight beyond the disclosure itself. Field 7 is the same substance a data processing agreement has to pin down, examined in the piece on the AI clauses a DPA now has to carry. Field 9 determines which regimes apply to you at all.

What to ask a vendor, and how to read the answer

Most suppliers cannot produce an AIBOM today. That is not disqualifying. What the answer tells you is how much of their own stack they have mapped.

Ask one question in the security review: which models does this product call, and how will you tell us when that changes. The answers cluster into three patterns.

The third answer is common and is not always evasive. In a product that routes across several providers by cost or availability, a fixed model list would be inaccurate within weeks. That is a legitimate reason to answer at the provider level rather than the model level, and it is also exactly why field 12 matters more than field 2. Where this sits inside a wider programme is set out in the maturity model for AI and agent governance.

Where this argument is weakest

The case for AIBOMs assumes the SBOM worked. That assumption deserves a harder look than it usually gets.

The SBOM record is not encouraging

ENISA surveyed SBOM adoption in late 2025 and published the results in June 2026. The findings are a warning rather than a precedent to copy.

78% of organisations have begun adopting SBOM practices. Only 9% report a fully mature, highly automated implementation. 62% rated achieving high completeness as quite difficult or extremely difficult, 54% cited accuracy concerns, and 39% generate SBOMs during the software build, which is the point at which the data is most reliable.

ENISA's own reading is that the Cyber Resilience Act is accelerating adoption, and 79% of respondents expect to reach the needed maturity by the time the CRA fully applies. That is a forecast made by the people being measured. Treat it as intent rather than as a result.

The case that this is premature

There is a serious argument that the AIBOM is being standardised before anyone knows what it is for. Friedman's objection is the strongest form of it: several clusters describe properties that cannot be measured consistently across organisations.

Dataset provenance is the clearest example. A supplier using a commercial foundation model genuinely does not know what it was trained on beyond the provider's own summary. Requiring that field produces a document that faithfully records ignorance.

There is also a real cost. Every field is a maintenance obligation, and a stale AIBOM is worse than none, because it invites reliance. The honest position is that fields 1, 2, 3, 7 and 12 are worth the cost today, and several of the others are not yet. We would not ask a 15-person supplier for the full seven clusters, and we would not accept a refusal on the five.

The regulatory split that decides whether this sticks

Whether the AIBOM becomes standard practice or a filed document depends on a split that opened in 2026, and it runs between two jurisdictions rather than between two industries.

Europe is hardening. The AI Act's high-risk documentation duties applied from 2 August 2026, and the Cyber Resilience Act's SBOM requirement lands on 11 December 2027. Neither says AIBOM. Both require a manufacturer to write down what is inside a product, and one of them covers the data that determines how the product behaves. The wider EU compliance surface is broken out in the transparency checklist for the AI Act.

The United States moved the other way. OMB memorandum M-26-05, issued on 23 January 2026, rescinded M-22-18 and M-23-16 and made the secure software self-attestation optional, replacing it with an agency-led risk-based approach. Agencies may still ask for an SBOM. They no longer have to. Wiley's analysis of the change notes the related FAR case was closed because the policy it implemented no longer exists.

So the AIBOM arrives in a year when the largest software buyer in the world softened its own transparency mandate. Our read is that this makes buyer demand, not regulation, the thing that decides it outside Europe. Enterprise security reviews already ask harder AI questions than most procurement rules do, and the cost of an unmapped model layer shows up in incident response rather than in an audit, a dynamic quantified in the analysis of what unsanctioned AI use adds to a breach.

Frequently asked questions

Where to start this week

Pick one product you sell and one vendor you buy from. Do the same exercise on both, in that order, because the internal version is faster and tells you how hard the external ask really is.

On the product you sell, fill fields 1, 2, 3, 7 and 12 from the template above. If the model inventory takes more than an hour to assemble, that is the finding, and it is the same finding your buyers will reach next quarter.

On the vendor you buy from, send the one-line question from the previous section into your next security review. Record which of the three answer patterns you get, and file the reply next to the data processing agreement. In six months you will have a baseline drawn from the suppliers you actually depend on.

Related reading