Compare

SBOM vs SCITT: how they differ, side by side

How SBOM and SCITT differ: what each is, who owes it, when it applies and who enforces it.

SBOMGuidance; binding only where a contract or sector rule requires it

SCITTVoluntary standard

Checked21 Oct 2026

01 / Side by side

SBOM and SCITT, side by side

	SBOM	SCITT
What it is	guidance	technical specification
Jurisdiction	United States (federal)	International
Legal force	Guidance; binding only where a contract or sector rule requires it	Voluntary standard
Status	Published standard	Published standard
Applies from	12 Jul 2021	June 2026
Who owes it	Software producers selling to federal agencies or regulated buyers, and organizations that procure or operate software.	Issuers of supply chain statements (e.g. software producers, auditors), operators of transparency services, and relying parties that verify them.
Enforcement	No general penalty. Federal agencies may require SBOMs by contract (OMB M-26-05); other mandates come from sector rules and foreign law.	None; voluntary.

02 / SBOM

What SBOM requires

The 2026 baseline expressly covers AI software but adds no AI-specific fields; CISA and G7 partners issued separate AI SBOM minimum elements in May 2026 as a supplement.

01Produce SBOMs with the 17 minimum data fields, including component producer, version, identifiers, hash value and license.
02Record SBOM author, timestamp, tool name and version, and generation context (lifecycle phase).
03Sign the SBOM so recipients can confirm it is unaltered (SBOM Author Signature).
04Use machine-processable formats such as SPDX or CycloneDX and update the SBOM when components change.
05For federal cloud contracts with SBOM terms, provide an SBOM of the runtime production environment on request.

03 / SCITT

What SCITT requires

Any statement about an AI artifact, such as a model card, evaluation result or dataset hash, can be registered and receipted. The RFC targets software supply chains and does not address AI specifically.

01Issuers sign statements as COSE_Sign1 messages about a specific artifact.
02Transparency services keep an append-only, non-equivocating log that cannot modify, delete or reorder entries.
03Transparency services publish and apply a registration policy, itself recorded on the log.
04Transparency services register a statement before releasing its COSE receipt (RFC 9942).
05Relying parties and auditors verify receipts and log consistency rather than trusting the operator.

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES