Software supply chain security is one of the many priorities shaping the Department of Homeland Security’s mission. Author of SBOM data becomes SBOM author, and version of the component becomes component version. For AI, it points to separate guidance CISA issued in May with the G7 Cybersecurity Working Group, titled Software Bill of Materials for AI – Minimum Elements. Canada, France, Germany, Italy, Japan, the United Kingdom and the European Union took part in that effort, which offered recommendations tailored to AI supply chains. The authors flagged four areas for further work: cloud software, AI software, validating SBOM accuracy and correlating SBOM data with security advisories such as Vulnerability Exploitability eXchange and the Common Security Advisory Framework.