G7 Nations Publish AI Supply Chain Security Guidelines
Government Agencies Publish Joint Guidance for Software Bill of Materials (SBOM) Creation for Artificial Intelligence Systems
In a collaborative effort, government agencies from the Group of Seven (G7) nations have issued guidance aimed at enhancing transparency in artificial intelligence (AI) systems and supply chains through the creation of software bills of materials (SBOMs).
Key Clusters Included in the Guidance
-
Metadata:
This cluster includes details about the SBOM itself, such as its author, version, data format, author signature, tool name and version, generation context, timestamp, and dependency relationship.
-
Models:
This cluster contains information about the AI system, including name, producer, version, components, timestamp, data flow and usage, input/output properties, and intended application area.
-
Key Performance Indicators (KPI):
The KPI cluster should contain information on security metrics and operational performance.
-
Infrastructure:
This cluster contains information about the software and hardware used to operate and support the AI system.
-
Security Properties (SP):
SP should cover security controls, security compliance, cybersecurity policy information, and vulnerability referencing.
-
System Level Properties (SLP):
The SLP cluster should contain information about the AI system, including name, producer, version, components, timestamp, data flow and usage, input/output properties, and intended application area.
-
Dataset Properties (DP):
The DP cluster should include information about the datasets used by the model.
Experts note that these minimum elements are not mandatory and do not create requirements, standards, or legislation. They are open to further refinements to keep pace with technological development and evolution of legal or policy frameworks within G7 member states.
Eduard Kovacs, a cybersecurity researcher, highlights the challenges posed by the increasing complexity of AI-assisted development. He notes that GenAI tools have made it routine for developers to create applications or pull in software dependencies outside any formal review pipeline, which makes traditional SBOMs less effective.
The release of the AI SBOM guidance marks a significant step towards enhancing transparency in AI systems and supply chains. As AI continues to evolve and play a larger role in various industries, the importance of robust security measures cannot be overstated. By implementing SBOMs, organizations can better manage risks associated with AI-powered systems and ensure the secure development and deployment of AI technologies.