A case for how to shape \u2018ingredient lists\u2019 for AI models | CyberScoop<\/title> <meta name=\"description\" content=\"A new policy paper outlines a roadmap for AI Bill of Materials (AIBOM) policy, urging standard frameworks to curb cyber risks and boost supply chain transparency.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/ai-bill-of-materials-policy-roadmap\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"A case for how to shape \u2018ingredient lists\u2019 for AI models\"> <meta property=\"og:description\" content=\"A new policy paper outlines a roadmap for AI Bill of Materials (AIBOM) policy, urging standard frameworks to curb cyber risks and boost supply chain transparency.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/ai-bill-of-materials-policy-roadmap\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\"> <meta property=\"article:published_time\" content=\"2026-06-16T16:00:00+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/a-case-for-how-to-shape-ingredient-lists-for-ai-models-2.jpg\"> <meta property=\"og:image:width\" content=\"2023\"> <meta property=\"og:image:height\" content=\"1481\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Tim Starks\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@timstarks\"> <meta name=\"twitter:site\" content=\"@CyberScoopNews\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1778775768g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1778005960g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1775068334g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=13897d660a0ac2c9c7d1\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/89437\"><meta name=\"generator\" content=\"WordPress 6.8.5\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=89437\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fai-bill-of-materials-policy-roadmap%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fai-bill-of-materials-policy-roadmap%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"wp-singular post-template-default single single-post postid-89437 single-format-standard wp-theme-scoopnewsgroup wp-child-theme-cyberscoop\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/ai-bill-of-materials-policy-roadmap\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"27.155555555556\">\n<div class=\"single-article__header-content\" readability=\"37.399568034557\">\n<p> AI bills of materials (AIBOMs), modeled on standards that worked for software, could transform how policymakers understand and regulate AI. A new roadmap outlines what they need to include and how to get there. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/89437\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"469\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/a-case-for-how-to-shape-ingredient-lists-for-ai-models.jpg?resize=640%2C469&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/a-case-for-how-to-shape-ingredient-lists-for-ai-models-2.jpg 2023w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/a-case-for-how-to-shape-ingredient-lists-for-ai-models-2.jpg?resize=300,220 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/a-case-for-how-to-shape-ingredient-lists-for-ai-models-2.jpg?resize=768,562 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/a-case-for-how-to-shape-ingredient-lists-for-ai-models-2.jpg?resize=1024,750 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/a-case-for-how-to-shape-ingredient-lists-for-ai-models-2.jpg?resize=1536,1124 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/a-case-for-how-to-shape-ingredient-lists-for-ai-models-2.jpg?resize=600,439 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/a-case-for-how-to-shape-ingredient-lists-for-ai-models-2.jpg?resize=229,168 229w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/a-case-for-how-to-shape-ingredient-lists-for-ai-models-2.jpg?resize=460,337 460w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/a-case-for-how-to-shape-ingredient-lists-for-ai-models-2.jpg?resize=922,675 922w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/a-case-for-how-to-shape-ingredient-lists-for-ai-models-2.jpg?resize=1152,843 1152w\" sizes=\"(max-width: 922px) 100vw, 922px\"><figcaption> The SBOM, commonly described as an inventory of software ingredients, emerged in the 2010s and has expanded beyond software to include hardware and AI. (Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"42.177628171932\"><body readability=\"87.764208685514\"><\/p>\n<p>A policy paper published Tuesday advocates for software bills of materials (SBOMs) for artificial intelligence as a mechanism for reducing cyber risk and improving transparency, and seeks to give lawmakers, federal agencies and others a roadmap on how to proceed.<\/p>\n<p>The SBOM, commonly described as an inventory of software ingredients, emerged in the 2010s and has expanded beyond software to include hardware and <a href=\"https:\/\/cyberscoop.com\/tag\/ai\/\">AI<\/a>.<\/p>\n<p>But <a href=\"https:\/\/securityandtechnology.org\/virtual-library\/policy-memo\/driving-ai-transparency\/\">the paper<\/a> from the <a href=\"https:\/\/cyberscoop.com\/tag\/institute-for-security-and-technology\/\">Institute for Security and Technology<\/a>, which CyberScoop is the first to report on, argues that AIBOMS require foundational work before they can be widely implemented. This comes as some companies are already offering AIBOM services and <a href=\"https:\/\/cyberscoop.com\/g7-cisa-ai-sbom-security-guidance\/\">other organizations<\/a> are actively shaping AIBOM policy.<\/p>\n<p>\u201cWhat we\u2019re worried about is we would end up in a \u2018fire, ready, aim\u2019 situation where everyone was doing it, but we were all doing slightly different things,\u201d said a co-author of the paper, Allan Friedman, who has worked on SBOMs in multiple U.S. government roles. \u201cIf we don\u2019t have a shared vision, it becomes a lot harder to have a coherent policy. It becomes a lot harder to have common tools and interoperable data and it becomes a lot harder to use the data that we\u2019re tracking to actually deliver on the promise of supply chain transparency.\u201d<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The idea for the paper sprung from discussions with Hill aides and Pentagon staffers, Friedman said, and people like them are the target audience as well.<\/p>\n<p>A key premise is that AIBOM policy needs to explore the topic from two sides.<\/p>\n<p>\u201cHow do you solve the chicken-and-egg issue, where no one\u2019s providing the data, so no one\u2019s asking for it, and no one\u2019s asking for it, so no one\u2019s providing it?\u201d Friedman told CyberScoop. \u201cThe answer is, you have to go from both supply and demand.\u201d<\/p>\n<p>On the supply side, \u201cAn AIBOM should capture relevant details about the models and datasets used for training, fine-tuning, evaluation, validation, testing, retrieval, grounding, augmentation, or other model development or operational purposes,\u201d the paper suggests.<\/p>\n<p>\u201cThe demand side begins with some form of forcing function or requirement that organizations understand what is in the products they manufacture and sell,\u201d it states, with one such requirement potentially being an industry mandate to require the tracking of system components \u2014 for example, like the \u201clightweight\u201d standards used in the payment card industry on data security that isn\u2019t overly exact about how components should be tracked.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>But it could also include government regulations or contracting conditions, Friedman argues with his Institute for Security and Technology colleague Nick Leiserson. (The scope of government directives on AI is a topic of considerable debate <a href=\"https:\/\/www.politico.com\/news\/2026\/06\/13\/republicans-ai-josh-hawley-tech-republicans-artificial-intelligence-00961315\">on Capitol Hill<\/a> and <a href=\"https:\/\/cyberscoop.com\/donald-trump-white-house-ai-executive-order-scaled-back\/\">within the Trump administration<\/a> right now.)<\/p>\n<p>Friedman said the paper isn\u2019t meant to be the be-all, end-all, and acknowledged the prior work of organizations like the Open Worldwide Application Security Project (<a href=\"https:\/\/cyberscoop.com\/tag\/owasp\/\">OWASP<\/a>) and Linux Foundation.<\/p>\n<p>\u201cWe\u2019re not saying this is a brand new topic, nor are we saying that AIBOM will solve all AI security issues,\u201d he said. \u201cI\u2019ve been fighting this fight for <a href=\"https:\/\/cyberscoop.com\/tag\/sbom\/\">SBOM<\/a> for a decade. You know, SBOM will not pick up your dry cleaning.\u201d<\/p>\n<p>And as AI continues to evolve rapidly, that means papers like the one published Tuesday are just at the beginning of the discussion, Friedman said.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\">\n<div class=\"author-card\" readability=\"7.7216117216117\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/a-case-for-how-to-shape-ingredient-lists-for-ai-models-1.jpg?w=640&ssl=1\" alt=\"Tim Starks\"> <\/figure>\n<\/p><\/div>\n<div class=\"author-card__details\" readability=\"10.901098901099\">\n<h4 class=\"author-card__name\">Written by Tim Starks<\/h4>\n<p> Tim Starks is senior reporter at CyberScoop. His previous stops include working at The Washington Post, POLITICO and Congressional Quarterly. An Evansville, Ind. native, he’s covered cybersecurity since 2003. Email Tim here: <a href=\"mailto:tim.starks@cyberscoop.com\">tim.starks@cyberscoop.com<\/a>. <\/div>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/ai-bill-of-materials-policy-roadmap\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A case for how to shape \u2018ingredient lists\u2019 for AI<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[235,384,655,1351,1807,117,4439,6329,5810,817,5889],"tags":[236,388,657,1353,1810,119,4440,6334,5812,821,5895],"class_list":["post-8748","post","type-post","status-publish","format-standard","hentry","category-ai","category-artificial-intelligence-ai","category-congress","category-department-of-defense-dod","category-exclusive","category-government","category-institute-for-security-and-technology","category-linux-foundation","category-owasp","category-regulation","category-sbom","tag-ai","tag-artificial-intelligence-ai","tag-congress","tag-department-of-defense-dod","tag-exclusive","tag-government","tag-institute-for-security-and-technology","tag-linux-foundation","tag-owasp","tag-regulation","tag-sbom"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ai\/\" rel=\"category tag\">AI<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/artificial-intelligence-ai\/\" rel=\"category tag\">artificial intelligence (AI)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/congress\/\" rel=\"category tag\">Congress<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/department-of-defense-dod\/\" rel=\"category tag\">Department of Defense (DOD)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/exclusive\/\" rel=\"category tag\">Exclusive<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/government\/\" rel=\"category tag\">Government<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/institute-for-security-and-technology\/\" rel=\"category tag\">Institute for Security and Technology<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/linux-foundation\/\" rel=\"category tag\">Linux Foundation<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/owasp\/\" rel=\"category tag\">OWASP<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/regulation\/\" rel=\"category tag\">regulation<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/sbom\/\" rel=\"category tag\">SBOM<\/a>","tag_info":"SBOM","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8748","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=8748"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8748\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=8748"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=8748"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=8748"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":8748,"date":"2026-06-16T11:00:00","date_gmt":"2026-06-16T16:00:00","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=89437"},"modified":"2026-06-16T11:00:00","modified_gmt":"2026-06-16T16:00:00","slug":"a-case-for-how-to-shape-ingredient-lists-for-ai-models","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2026\/06\/16\/a-case-for-how-to-shape-ingredient-lists-for-ai-models\/","title":{"rendered":"A case for how to shape \u2018ingredient lists\u2019 for AI models"},"content":{"rendered":"