G7 Publish SBOM Minimum Standards for AI Systems

First G7 Guideline for AI SBOMs Is Available

On 12 May 2026, as part of the French G7 Presidency, the BSI published the document “Software Bill of Materials for AI – Minimum Elements”. It is the first consensus-based G7 guideline on the minimum elements of an SBOM for AI systems and complements the “Shared G7 Vision on SBOM for AI” published in June 2025. The paper was developed between August 2025 and February 2026 within the G7 Cybersecurity Working Group, co-led by Italy (ACN) and Germany (BSI).

The focus is on a practical, cross-sectoral minimum framework for greater transparency along the AI supply chain — from models and training data through infrastructure to security-relevant properties. According to the BSI document, the minimum elements are explicitly not mandatory and do not create new standards or laws, but are intended to support manufacturers and operators in their implementation.

The guideline emphasises an important principle: AI systems are also software systems. The minimum elements defined here come in addition to classic SBOM minimum standards (e.g. those of NTIA or CISA); they do not replace them.

Seven Clusters — The Skeleton of the AI SBOM

According to the G7 guideline, an AI SBOM is structured into seven thematic clusters. Apart from the Metadata cluster, which describes the SBOM itself, the remaining six clusters are of equal rank. This structure makes it possible to cleanly represent the additional properties of an AI system – in particular models and datasets – alongside classic software components.

Models and Datasets: What Specifically Needs to Be Documented

The heart of the AI SBOM lies in the Models and Datasets Properties clusters. They require unambiguous identifiability, cryptographic integrity and traceable origin — both of model weights and of training data.

Particularly noteworthy: for hash algorithms the guideline refers to the IANA Hash Function Textual Names, for UUIDs to RFC 9562, for timestamps to RFC 9557and for digital signatures to ISO/IEC 14888-4:2024 and the ENISA Agreed Cryptographic Mechanisms. This gives AI SBOMs a very clear technical foundation.

{
  "metadata": {
    "sbom_author": "Example AG",
    "sbom_version": "1.0.0",
    "sbom_data_format_name": "SPDX",
    "sbom_data_format_version": "3.0",
    "sbom_tool_name": "ExampleScanner",
    "sbom_generation_context": "after-build",
    "sbom_timestamp": "2026-05-13T09:00:00Z"
  },
  "models": [{
    "model_name": "vision-classifier",
    "model_identifier": "pkg:huggingface/example/vision-classifier@1.4.2",
    "model_hash_algorithm": "sha-256",
    "model_hash_value": "9f86d081884c7d659a2feaa0c55ad015...",
    "model_properties": { "architecture": "transformer-encoder", "parameters": 1300000000 },
    "model_training_properties": { "type": "supervised + RLHF" },
    "model_license": "Apache-2.0"
  }],
  "datasets": [{
    "dataset_name": "internal-images-2026",
    "dataset_provenance": "internal capture + licensed partner data",
    "dataset_sensitivity": "PII redacted",
    "dataset_license": "proprietary"
  }]
}

Security, Infrastructure and KPIs — Often Overlooked

Three often underestimated clusters round off the AI SBOM. They link the pure inventory view with the cybersecurity reality in operations:

The KPI cluster is intentionally kept lean: Security Metrics (e.g. robustness against third-party manipulation) as well as Operational Performance KPIs (uptime, incident resolution time, latency, throughput). This data is the bridge between the SBOM inventory and SOC/monitoring reality.

What the Guideline Means for Manufacturers and Operators

The G7 guideline does not create direct legal obligations. In some jurisdictions, however, individual elements are already being addressed through existing or upcoming standards — for example via the EU AI Act, the Cyber Resilience Act (CRA) or sector-specific requirements. Anyone shipping or deploying AI components in products should treat the seven clusters as a target architecture.

Blackfort Assessment

With this guideline, the G7 states have for the first time presented a consensus-based minimum framework for AI SBOMs. Its strength lies in the sober alignment with established SBOM concepts: no new standards landscape, but a focused extension to cover AI-specific aspects. In its announcement, the BSI states together with the partner agencies that the minimum elements remain open to further development — particularly with regard to agentic AI and the degrees of autonomy of AI systems, which are explicitly named as a future element.

This is relevant for German industry because manufacturers are already being obliged to provide component transparency through the CRA and AI Act. Anyone who builds a clean AI-SBOM practice now avoids duplicate work and can simultaneously professionalise vulnerability management and supplier governance. Blackfort recommends treating the seven clusters as a design specification today — and not only once the regulator or customer asks.