Federal SBOM policy is moving past packaged software. The new baseline says AI systems and SaaS in cloud environments may need extra elements, so the old 2021 model is no longer the full answer for product transparency.
CISA, NSA, FBI, and international partners published the 2026 Minimum Elements for an SBOM, replacing NTIA’s 2021 guidance. The update keeps the core SBOM idea intact but adds that AI and SaaS/cloud software may need more than the minimum set, reflecting current tools and supply-chain needs.
For vendors, the practical shift is that cloud delivery and model-linked dependencies now sit inside the SBOM conversation, not beside it.