📚 SBOM for AI Use-Cases

• Executive Summary
• Common Audience and Roles
• Introduction
• Detailed SBOM for AI Use Cases
  • Use Case 1: Compliance
  • Use Case 2: Vulnerability and Incident Management
  • Use Case 3: Assessing Risk in Open-Source Models & Datasets
  • Use Case 4: Third-Party AI Risk Management
  • Use Case 5: Intellectual Property & Legal Usage
  • Use Case 6: Model Tracking, Reproducibility, and Lifecycle Management
• Key Recommendations and Looking Ahead
• Appendix
  • SBOM for AI Glossary and Terminology
  • Acknowledgments

About the Document

🧾 Use cases and recommendations to operationalize Software Bills of Materials (SBOMs) for Artificial Intelligence (AI).

CISA SBOM for AI Tiger Team

Version: 0.3 Draft (Google Doc Version) (PDF Version)

Date: June 23, 2025

📝 Disclaimer

This document was drafted in an open process by a community of Software Bill of Materials (SBOM) experts, facilitated by the Cybersecurity and Infrastructure Security Agency (CISA). CISA did not draft and is not the author of this document, nor does this document represent an official CISA and/or U.S. Government policy. CISA and the U.S. Government do not specifically adopt or endorse the views expressed in this document. Nothing in this document should be considered binding on any organization and instead should be viewed as forming a basis for future requirements covering SBOM consumption and usage.

Overview of the SBOM for AI Tiger Team

🚀 The SBOM for AI Tiger Team is a collaborative initiative launched in May 2024, following our inaugural AIBOM workshop at RSAC 2024. Since then, we’ve worked across the industry to define real-world use cases, with contributions from distinguished experts and broad community review.

🎯 Our mission is to promote industry-wide transparency, security, and risk management for AI systems through the development of SBOM for AI guidelines.

✅ As a result of our efforts, the team has finalized the first public draft of the SBOM for AI Use Cases, now available for the community to use on this GitHub (see below) and will be published on CISA.gov.

🧩 Our ongoing work involves mapping these use cases to technical formats, such as CycloneDX and SPDX, to facilitate practical adoption. To learn more or get involved, visit this page.