G7 Agencies Set Voluntary Baseline for AI Software Bills of Materials
Summary
G7 agencies, including CISA, issued voluntary guidance on AI software bills of materials to improve transparency and identify supply-chain risks. Experts welcomed its scope but cited implementation and runtime gaps.
Key points
- The G7 guidance sets voluntary, non-exhaustive baseline elements for AI software bills of materials, also called AIBOMs.
- Its scope includes AI models, lifecycle datasets, supporting infrastructure, cybersecurity measures, and system performance indicators.
- The guidance aims to make AI components and their origins more visible so organizations can better identify supply-chain risks.
- Industry experts welcomed the baseline as a step toward AI transparency and trust.
- Experts also raised concerns about implementation challenges and insufficient coverage of runtime.
Article Details
- Event Type
- G7 agencies released voluntary guidance on the minimum elements for AI software bills of materials (AIBOMs).
- Impact
- The guidance aims to improve AI transparency and help identify supply-chain risks by covering the AI system, models, datasets, supporting infrastructure, cybersecurity measures, and performance indicators. Industry experts welcomed it as a baseline but raised concerns about implementation details and runtime coverage; the guidance is voluntary and its elements are not mandatory.
People
Allan FriedmanWorked on SBOMs in multiple U.S. government roles and commented that the guidance lists potentially useful elements rather than mandatory minimums.Daniel BardensteinCEO of Manifest Cyber; built an AIBOM generator and worked on AIBOMs with CISA and the OWASP Foundation. He commented on the guidance's value and implementation challenges.Dmitry RaidmanCo-founder and chief technology officer at Cybeats; built an AIBOM generator and worked on AIBOMs with CISA and OWASP. He welcomed the guidance's baseline while noting its limited coverage of runtime.