Projekt 1034: Technische Umsetzung einer SBOM für KI (SBOM4AI)

The Federal Office for Information Security seeks to develop a technical implementation that automatically generates a Software Bill of Materials for artificial‑intelligence systems, referred to as SBOM4AI. The project focuses on translating the “SBOM for AI – Minimum Elements” concept, introduced within the G7 framework, into a practical, reusable solution that can be applied by all stakeholders to enhance the cybersecurity profile of AI systems. The goal is to create a comprehensive, machine‑readable parts list detailing the software components and dependencies that comprise an AI system, thereby improving supply‑chain transparency and supporting compliance with the Cyber Resilience Act’s requirements for software auditability.

The procurement specifically requires a system that automatically compiles the necessary information, constructs the SBOM according to the defined minimum elements, and outputs it in a format suitable for use by developers, auditors, and governing bodies. The deliverable will be made available to all relevant parties, ensuring that the resulting SBOM can be utilized for ongoing risk assessment, component management, and regulatory reporting. The solution must be designed with scalability, interoperability, and ease of integration into existing AI development pipelines in mind, while upholding the highest standards for data integrity and security.

The implementation must produce the SBOM for AI according to the SBOM4AI Minimum Elements defined by the G7 framework and output it in a compliant, machine‑readable format.

Description