Enterprise AI BOM Field Requirements Matrix — Required and Optional Fields Defined by Standards and Regulatory Grounds
Weighs the 50 elements of the G7 “SBOM for AI — Minimum Elements” against authoritative standards — SPDX 3.0.1, CycloneDX 1.6, NTIA 2021, OpenChain AI V1 — and regulatory grounds including the CRA, the AI Act, and FDA guidance, to determine which AI BOM fields are required and which are optional. Part of a five-part series that also applies the same matrix to production, ingestion, and supplier contexts and covers toolset strategy.