ENISA has issued a technical advisory intended to help organisations adopt software bills of materials. The guidance focuses on practical implementation and the needs of smaller organisations and software stewards, linking SBOM practice to secure-by-design and secure-by-default expectations. An SBOM is an inventory, not a guarantee: its value depends on coverage, accuracy, update frequency and the ability to act on the information.
The timing matters as AI systems accumulate dependencies across model serving, agent frameworks, connectors, plugins and conventional software libraries. A static list can age quickly, while generated or third-party components may be hard to identify. Enterprises therefore need a process that links component identity to vulnerability intelligence, ownership, remediation and evidence for customers and regulators.
