valerybrozhinsky - stock.adobe.c

Modern software runs on open source. Nearly all codebases -- 98% -- contain open source code, according to a 2026 report from cybersecurity vendor Black Duck, which scanned 947 codebases and analyzed nearly 3,000 individual projects between November 2024 and October 2025. Those open source components change constantly as maintainers ship patches, fixes and new versions.

A software bill of materials (SBOM) captures a snapshot of that inventory, so organizations can find and patch vulnerabilities quickly. The moment a developer merges a dependency update or a build pulls a new version, the document drifts from reality. A stale SBOM gives false confidence and slows the enterprise response when a vulnerability lands.

Regulation raises the stakes. Under the EU Cyber Resilience Act, beginning Sept. 11, 2026, organizations must report actively exploited vulnerabilities. By Dec. 11, 2027, manufacturers of products with digital elements must include machine-readable SBOMs in their technical documentation. Penalties for non-compliance could reach 15 million euros or 2.5% of global annual turnover. In the U.S., CISA and its partner agencies published joint SBOM guidance in September 2025 that pushes wider adoption. Unlike manual upkeep, AI tools can meet these demands at scale.

AI-driven tools treat the SBOM as a living inventory rather than a one-time artifact. They combine automation with machine learning across the following four functions.

• Continuous generation. The tools plug into your CI/CD pipeline and regenerate the SBOM on every build, so the inventory automatically tracks each release.
• Component identification. Machine learning models, including natural language processing and graph neural networks, identify and classify components and trace transitive dependencies. One multi-model system, for example, reported 94.7% component detection and 91.3% accuracy in vulnerability mapping.
• Drift detection. AI-driven tools compare the build-time SBOM against what actually runs in production to catch unauthorized packages, supply chain tampering and configuration drift.
• Vulnerability correlation. AI enriches each component with exploitability intelligence and ranks findings by reachability, rather than raw CVE counts, so the highest-risk issues surface first.

For a CISO, the value of AI for SBOM creation and maintenance lies in accuracy, speed and audit-readiness.

• Accuracy at scale. AI continuously updates inventory across hundreds of repositories, a task no human team can match by hand.
• Faster incident response. When the next Log4Shell-class flaw appears, a current inventory answers the question "are we affected" in minutes instead of days.
• Less noise. Reachability analysis filters out components that pose no real exposure risk, so analysts spend time on issues that matter.
• Compliance readiness. An always-current, machine-readable SBOM satisfies auditors, customers and regulators on demand.

AI does not remove the need for human judgment. Weigh the risks before you rely on it for SBOMs or anything else. CISOs should consider the following:

• False positives and negatives. Automated tools can flag components that are not in production or miss ones loaded dynamically at runtime. Human review still matters.
• Model opacity. When a model classifies or discards a component, the reasoning can be hard to audit. Demand explainable output you can log and defend.
• Data quality limits. An AI inventory is only as good as the sources it reads. Poor package metadata and incomplete scans produce a confident but incorrect SBOM.
• Automation bias. Teams can over-trust a polished dashboard and stop verifying it. Treat AI output as a strong draft, rather than the final truth.
• A new attack surface. The AI tooling and its models become part of your supply chain. Vet them as you would any other dependency, and track your own AI components too.

CISOs who decide to automate SBOM management with AI should start with the following steps:

• Embed SBOM generation in every CI/CD pipeline so it runs on each build.
• Compare build-time and runtime SBOMs to catch drift before attackers do.
• Require explainable output and use human-in-the-loop reviews to verify high-risk findings.
• Prioritize flaws by reachability and exploitability, not raw vulnerability counts.
• Vet your SBOM AI tools, models and training data as supply chain components.
• Map your process to regulatory timelines now, ahead of deadlines.

Additionally, beware of potential pitfalls.

• Don't treat the SBOM as a one-time document, rather than a living inventory.
• Don't trust AI output without validation and a clear audit trail.
• Don't ignore runtime drift because the build-time SBOM looks complete.
• Don't wait for regulators to force the conversation. By then, your company could be on the hook for hefty fines.

A current SBOM is the foundation for software supply chain security. AI keeps that inventory continuous and accurate at a scale that manual updates cannot match. By pairing AI tools with human oversight, CISOs can turn a compliance chore into a real-time view of supply-chain risk.

Matthew Smith is a vCISO and management consultant specializing in cybersecurity risk management and AI.

• Best practices to evaluate LLM-based AI security tools

  

  By: John Burke

• AI coding tools run riot over SBOM controls as EU CRA looms
• EU Cyber Resilience Act reporting: What CISOs need to know

  

  By: Samira Sarraf

• 3 ways dev teams use AI to improve software governance

  

  By: Twain Taylor