Probably yes. CISA's page for the 2026 minimum elements says some software types, such as AI systems and cloud based software as a service, may need additional elements beyond the minimum. Reporting adds that AI specific fields are not in the baseline and a separate May 2026 document covers AI SBOMs.
What CISA says
The CISA page describes the minimum elements as meant for software broadly, and says that AI systems and SaaS may need more. Reporting from Help Net Security says AI specific fields are not yet included, that CISA points to separate G7 AI SBOM guidance published in May 2026, and that cloud and SaaS specific elements may be added later.
I did not fetch the May 2026 AI SBOM document itself, so I cannot describe its fields here. Read it directly.
Why the minimum is not enough for AI
A traditional SBOM lists code components. An AI system also depends on things that are not packages: model weights, training data, fine tuning data, evaluation sets, and prompts or configuration. A list of libraries leaves most of that out.
The formats are moving. CycloneDX describes components that can include ML models, according to its specification overview, and covers declarations such as claims and evidence. Check the SPDX material too, since both communities have worked on AI related profiles.
Why SaaS is different
A SaaS product is not delivered as an artifact. The customer cannot unpack it. The inventory includes services and their dependencies, which CycloneDX models: components can depend on services, and services on other services, per its overview. How a baseline should treat live, changing services is exactly the open question CISA flags.
What to do now
- Produce the baseline SBOM for the code you control, covering the 17 fields.
- Add model and data components in a format that supports them, and say what is covered.
- For SaaS, document the service dependencies you can name, and state the limits.
- Version your approach and revisit it when CISA or your standards body updates guidance.
- Mark unknowns, as for any SBOM.
What not to claim
Do not call a code only SBOM an AI SBOM. A buyer who relies on it will assume models and data were covered.
Quick check
Is the AI SBOM guidance part of the 2026 minimum elements?
Per reporting, no. It is a separate May 2026 document that is supplemental.
Can CycloneDX describe ML models?
Its specification overview says components can include ML models.
Sources
- CISA, 2026 Minimum Elements for a Software Bill of Materials
- Help Net Security, CISA sets a new SBOM baseline
- CycloneDX specification overview
Last reviewed: 19 October 2026.
