Overview
The OWASP AIBOM Call #18 focused on Phase 2 progress, upcoming project deliverables, expansion of the workstreams, and continued growth across sponsorships, events, and collaborations.
Major updates included the provisional internal release of the AIBOM 101 guide, development of the curated AIBOM tools list, progress on policy guidance, and the launch of the new Agentic BOM (AgBOM) workstream. Sponsor Codacy also demonstrated its AI Inventory and AI Risk Hub capabilities and discussed how AI asset visibility can support future AIBOM adoption.
The team also reviewed the successful Prediction Guard workshop held in Las Vegas during DEF CON week, future online workshops and LinkedIn Live sessions, conference participation, and progress toward the project’s $100,000 sponsorship goal for 2026.
Action Items
Complete internal review of the AIBOM 101 guide and prepare it for public feedback.
Finalize and publish the curated AIBOM tools list.
Continue development of policy guidance covering an initial set of approximately 10 relevant regulations.
Launch the AgBOM workstream and begin defining scope, components, dependencies, and schema requirements.
Coordinate the online version of the Prediction Guard AIBOM workshop.
Continue planning LinkedIn Live sessions, including a future session with Codacy.
Expand conference and CFP tracking.
Continue university, industry, and cross-foundation collaboration.
Continue sponsorship outreach toward the 2026 funding goal.
Outline
Project Roadmap and Phase 2
Phase 1 has been completed, with Phase 2 now focused on deliverables, workstream execution, engagement, and sponsorship growth.
The AIBOM 101 guide entered provisional internal review on August 11.
Independent reviewers and contributors were invited to provide feedback.
A curated AIBOM tools list is also being prepared for release.
Future work will include closer alignment with standards such as CycloneDX and SPDX.
Codacy Sponsor Presentation
Codacy presented its AI Inventory and AI Risk Hub capabilities.
The platform identifies AI-related signals in source-code repositories, including models, SDKs, APIs, prompts, MCP servers, and AI-assisted development workflows.
Codacy discussed the growing need for organizations to understand what AI components are being used in software for security, compliance, and cost management.
The discussion also highlighted visibility challenges involving proprietary SaaS and low-code/no-code platforms where underlying AI components may not be exposed.
A deeper Codacy LinkedIn Live session is being planned.
Foundations, Policy, and Threat Intelligence
The Foundations workstream is focused on reviewing and preparing AIBOM 101 for wider release.
The Policy workstream is targeting an initial guidance release around the end of September 2026.
The first policy release is expected to cover approximately 10 major regulations, including work related to the EU AI Act.
Threat Intelligence will continue building on outputs from the Foundations and Policy workstreams.
New Agentic BOM (AgBOM) Workstream
The project announced the new Agentic BOM (AgBOM) workstream.
AgBOM aims to define a standardized and machine-readable Bill of Materials for agentic AI systems.
The workstream will look beyond models to include:
Agents
Tools
MCP servers
Memory
Orchestration
Dependencies between components
The proposed roadmap includes five phases:
Foundation
Discovery
Standardization
Tooling and Automation
Operationalization
Initial work will focus on defining scope and the component model before moving into schema and tooling.
The first AgBOM workstream meeting was scheduled for August 17.
Collaboration with other organizations working on agentic AI standards was encouraged.
Content, Workshops, and Events
Recent content activities included LinkedIn Live sessions with Manifest Cyber and Prediction Guard.
The first in-person AIBOM workshop was held in Las Vegas during DEF CON week with Prediction Guard.
Approximately 80 people registered for 25–30 available seats, demonstrating strong interest.
An online version of the workshop is being planned for those unable to attend in person.
The team also discussed creating preview content for upcoming project releases and expanding LinkedIn and webinar activity.
Additional conference participation and CFP opportunities are being tracked.
Collaboration and Sponsorship
Collaboration efforts continue across universities, industry groups, standards organizations, and other foundations.
Discussions are underway with additional academic and industry partners.
The project’s sponsorship goal remains $100,000 for 2026.
One additional potential sponsor was described as close to confirmation, with two more discussions in progress.
Community members were encouraged to introduce organizations working in AIBOM, AI security, and agentic AI.
Final Remarks
AIBOM 101 and the curated tools list are moving toward broader release.
Policy guidance and Threat Intelligence work continue to mature.
The AgBOM workstream is beginning its foundational phase.
Content, workshops, sponsorships, and external collaborations continue to expand.
Contributors were encouraged to participate through Slack and the individual project workstreams.
