Requirements for the AI BOM that a supplier providing AI models or systems to your organization must submit. Defines the standard data format, the information that must be included, identifier rules, and the requirements for licensing, provenance, and sensitivity.
Guidelines for the AI BOM that in-house development teams must produce when building an AI model or system. Drawing on the information accessibility available at the point of production, this sets out the required and recommended fields to fill and how to record integrity and provenance.
A checklist for vetting transparency and risk, on the basis of the AI BOM, when bringing in and using an external AI model or dataset. Checks identification, licensing, data lawfulness, and security risk step by step.
Surveys seven tool categories through their official repositories and documentation to lay out what to reuse, extend, or build new; the build order; the policy schema for codifying the matrix; and the Dependency-Track integration architecture.
An analysis of the revised SBOM minimum elements published on July 29, 2026 by CISA and 17 other agencies. The data fields grew from 7 to 17, and licensing entered the minimum baseline for the first time. Covers what an OSPO must decide before selecting a tool, how SBOM formats differ in their support, and how far the open source tool BomLens gets today.
Weighs the 50 elements of the G7 “SBOM for AI — Minimum Elements” against authoritative standards — SPDX 3.0.1, CycloneDX 1.6, NTIA 2021, OpenChain AI V1 — and regulatory grounds including the CRA, the AI Act, and FDA guidance, to determine which AI BOM fields are required and which are optional. Part of a five-part series that also applies the same matrix to production, ingestion, and supplier contexts and covers toolset strategy.
An analysis of the software supply chain security roadmap the government released on June 24, 2026. Covers the SBOM transparency management model, testbeds and consulting, pilot certification, a rapid detection-and-response system, and burden reduction for small and medium-sized enterprises, and their practical impact on exporting, public-sector, and small and medium-sized software companies.
Analyzes, from primary sources, “Software Bill of Materials for AI — Minimum Elements,” published by the G7 Cybersecurity Working Group on May 12, 2026. Covers the structure, background, regulatory alignment, and implications for Korean companies of the first G7 joint guidance to define, at the level of 7 clusters and 50 elements, what an SBOM applied to AI systems must contain.
A primary-source analysis of the US AI executive order (Promoting Advanced Artificial Intelligence Innovation and Security) signed on June 2, 2026. Covers what the AI Cybersecurity Clearinghouse and the voluntary frontier model framework mean for corporate open source managers, the contrast with EU CRA mandatory reporting, and what to do now versus what to watch.
The EU Cyber Resilience Act (CRA) brings its Article 14 reporting obligations into effect on September 11, 2026. This report, grounded in primary sources, sets out how Korean companies should prepare for the 24-hour, 72-hour, and 14-day notification deadlines and for SBOM and conformity assessment requirements.
An overview of what an SBOM is and why it is needed, covering software supply chain threats and the benefits an SBOM provides.
Summarizes SBOM levels based on the depth of information they contain, and classification based on when they are generated.
Summarizes the activities organizations undertake to build an SBOM program in stages, from establishing the foundation to operational maturity.
A guide covering the Software Bill of Materials (SBOM), from its concepts and standard formats to regulatory trends, adoption roadmap, tools, vulnerability management, and governance, organized from the perspective of practitioners in Korea.
Examines whether AI-generated code needs snippet-level open source license scanning, laying out the decision criteria from public sources and distinguishing this from the security vulnerability angle.