Jonathan Herman’s Post
Summary
CISA and a G7 working group published an AI Software Bill of Materials standard that defines seven minimum element clusters for production AI systems: Metadata, Models, Dataset Properties, System Level Properties, KPIs, Security Properties, and Infrastructure. The standard creates an auditable procurement trail and treats provenance (who trained models, on what data, and under which licenses) as a documented artifact rather than just vendor messaging. It expands supply-chain risk to include models and forces clearer dependency graphs for AI components. By naming hardware, network boundaries, and isolation as first-class infrastructure elements, the guidance increases the policy case for sovereign and air‑gapped AI deployments, a point highlighted by the referenced AirNode.ai sovereign-AI positioning.