Question · SBOM
What goes in an SBOM for a federal AI deployment?
An SBOM is a machine-readable list of a software product's components, versions, producers and dependencies.
01 / The answer
The short answer
An SBOM lists the software components of the deployed system and how they relate. CISA's 2026 Minimum Elements (July 29, 2026), which replace NTIA's 2021 baseline and expressly cover AI software and SaaS, set 17 data fields, including component producer, name, version, identifiers, hash value and algorithm, license and dependency relationships, plus the SBOM author, signature, timestamp, tool and generation context. A separate CISA and G7 guide from May 2026 adds AI-specific elements. Agencies are not required to demand SBOMs; under OMB M-26-05 they may require one on request by contract.
02 / The rule
What SBOM requires
An SBOM is a machine-readable list of a software product's components, versions, producers and dependencies. CISA's 2026 Minimum Elements, issued with NSA, FBI and 15 international partners, replaced NTIA's 2021 baseline and expanded it to 17 data fields covering all software, including AI software and SaaS.
- 01Produce SBOMs with the 17 minimum data fields, including component producer, version, identifiers, hash value and license.
- 02Record SBOM author, timestamp, tool name and version, and generation context (lifecycle phase).
- 03Sign the SBOM so recipients can confirm it is unaltered (SBOM Author Signature).
- 04Use machine-processable formats such as SPDX or CycloneDX and update the SBOM when components change.
03 / Records
Records to keep
- 01Signed SBOM per release in SPDX or CycloneDX
- 02Component hash values and license identifiers
- 03VEX or vulnerability status statements tied to SBOM components
- 04Contract clauses requiring SBOM delivery on request
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
CISA, NSA, FBI and international partners (hosted by FBI IC3)
Office of Management and Budget
RELATED
Related: SBOM: the full guide