CISA's 2026 SBOM Rules Require Component Hashes and AI Model Disclosure
The new CISA guidance replaces the 2021 baseline and makes cryptographic hashes mandatory for every SBOM component, letting teams verify the exact bytes deployed. It also expands the minimum elements to cover AI/ML model artifacts, pushing vendors to disclose model and dataset provenance. Together these changes raise the bar for software supply‑chain transparency and risk management.