--- title: CISA's 2026 SBOM Guidance Adds Hash Requirements and AI... description: CISA's 2026 Minimum Elements for a Software Bill of Materials replaces the 2021 NTIA baseline, expanding coverage to open-source software, AI systems, and... canonical: https://daily.dev/posts/cisa-s-2026-sbom-guidance-adds-hash-requirements-and-ai-coverage-1hyw7rtrb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CISA's 2026 SBOM Guidance Adds Hash Requirements and AI Coverage | daily.dev og:description: CISA's 2026 Minimum Elements for a Software Bill of Materials replaces the 2021 NTIA baseline, expanding coverage to open-source software, AI systems, and... og:url: https://daily.dev/posts/cisa-s-2026-sbom-guidance-adds-hash-requirements-and-ai-coverage-1hyw7rtrb og:image: https://api.daily.dev/og/posts/1Hyw7rtRb.png og:image:alt: CISA's 2026 SBOM Guidance Adds Hash Requirements and AI Coverage og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CISA's 2026 SBOM Guidance Adds Hash Requirements and AI Coverage **[DevOps.com](https://daily.dev/sources/devops)** · 6 min read · 0 upvotes · 0 comments ## Summary CISA's 2026 Minimum Elements for a Software Bill of Materials replaces the 2021 NTIA baseline, expanding coverage to open-source software, AI systems, and SaaS. Key additions include required component hash fields (enabling actual file verification rather than just name/version matching), component licenses, SBOM tool names, and generation context. The guidance is framed as a floor, not a ceiling, with AI and SaaS likely needing additional elements. Experts highlight that extending SBOM requirements to AI and SaaS shifts responsibility from build pipelines to vendor contracts, since there is no compile event to hook into. The deeper challenge remains continuous validation: generating a static SBOM document once is not proof of ongoing security. Both CycloneDX and SPDX already support the new hash fields, making adoption largely a configuration change for teams already using those formats. A January 2026 OMB memo also shifted federal posture away from blanket mandates toward agency-led, risk-based approaches, making solid baseline guidance more critical. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [CISA’s AI SBOM guidance pushes software supply-chain oversight into new territory](https://daily.dev/posts/cisa-s-ai-sbom-guidance-pushes-software-supply-chain-oversight-into-new-territory-vnizle2vv) · CSO Online · 0 upvotes · 0 comments - [From SBOM to AI BOM: Rethinking supply chain security for AI native software](https://daily.dev/posts/from-sbom-to-ai-bom-rethinking-supply-chain-security-for-ai-native-software-99um8qfag) · SD Times · 1 upvotes · 0 comments - [Software Bill of Materials \(SBOM\) Explained](https://daily.dev/posts/software-bill-of-materials-sbom-explained-x78srarkm) · Docker · 4 upvotes · 0 comments - [Is 2026 the Year AI Bills of Materials Get Real?](https://daily.dev/posts/is-2026-the-year-ai-bills-of-materials-get-real--ahp6k35wk) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#supply-chain](https://daily.dev/tags/supply-chain), [#sbom](https://daily.dev/tags/sbom) [View this post on daily.dev](https://daily.dev/posts/cisa-s-2026-sbom-guidance-adds-hash-requirements-and-ai-coverage-1hyw7rtrb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CISA's 2026 SBOM Guidance Adds Hash Requirements and AI Coverage","url":"https://daily.dev/posts/cisa-s-2026-sbom-guidance-adds-hash-requirements-and-ai-coverage-1hyw7rtrb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisa-s-2026-sbom-guidance-adds-hash-requirements-and-ai-coverage-1hyw7rtrb"},"datePublished":"2026-07-31T07:50:42.907Z","dateModified":"2026-07-31T19:31:18.707Z","description":"CISA's 2026 Minimum Elements for a Software Bill of Materials replaces the 2021 NTIA baseline, expanding coverage to open-source software, AI systems, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5474ecb5136d476795b29c86e1188927?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5474ecb5136d476795b29c86e1188927?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"DevOps.com","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"DevOps.com","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/db8f2265cff0416c878c6e7e92bb8715","url":"https://daily.dev/sources/devops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisa-s-2026-sbom-guidance-adds-hash-requirements-and-ai-coverage-1hyw7rtrb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"supply-chain,sbom","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DevOps.com","item":"https://daily.dev/sources/devops"},{"@type":"ListItem","position":3,"name":"CISA's 2026 SBOM Guidance Adds Hash Requirements and AI Coverage"}]} ```