Overview
The OWASP AIBOM Call #19 focused on Phase 3 progress, workstream deliverables, AI supply chain visibility, community growth, and expanding collaborations across industry and academia.
Major updates included the release of the OWASP AIBOM Foundations Guide v1.0 in multiple languages, continued development of the Agentic Bill of Materials (AgBOM) guidance, progress on policy and regulatory mapping, and the first activities of the Integrity and Quality workstream, including an early AIBOM integrity checker tool.
The project also celebrated surpassing 500 LinkedIn followers, reviewed recent conference engagements including the Midwest AI Summit 2026, and highlighted upcoming educational content, including the Codacy LinkedIn Live session on Shadow AI.
The discussion concluded with questions from industry practitioners on AIBOM standardization, differences between vendor implementations, component verification, and how organizations can maintain visibility into third-party AI systems and agentic workflows.
Action Items
Continue Phase 3 deliverables, strengthen coordination across workstreams, and maintain the centralized project management dashboard.
Resume the Foundations workstream on November 2 with a biweekly meeting cadence.
Continue collecting feedback on the Foundations Guide v1.0 and supporting its multilingual availability.
Advance the Policy workstream’s EU AI Act mapping, focusing on practical guidance and supporting evidence for industry practitioners.
Continue developing the AI regulations and frameworks tracker for potential publication as an interactive website resource.
Complete the initial AgBOM 101 draft targeted for the end of October and prepare it for contributor review.
Coordinate Foundations and AgBOM outputs to support future Threat Intelligence mapping.
Expand testing of the AIBOM Integrity Checker, review validation results, evaluate digital-signature capabilities, and contribute the code to the project’s GitHub repository.
Begin documenting integrity and quality verification requirements for a future guidance document.
Continue educational blogs, webinars, and LinkedIn Live sessions, including the October 21 session with Codacy.
Explore academic collaborations and opportunities to align with related OWASP initiatives.
Continue sponsorship outreach toward the project’s $100,000 funding goal for 2026.
Encourage new contributors to join the community Slack channels and participate in relevant workstreams.
Outline
Project Roadmap and Phase 3
Phase 1, running from approximately August–September 2025 through February 2026, established the project’s foundational infrastructure, communications channels, initial tooling index, and sponsorship activities.
Phase 2, covering March through August 2026, focused on foundational deliverables, workstream development, and community engagement.
The project is currently in Phase 3, September 2026 through January 2027, emphasizing publications, workstream execution, project management, and external collaboration.
A centralized project management dashboard is being introduced to track work across stages such as backlog, ready, in progress, and review.
The dashboard is intended to improve task ownership, transparency, and coordination between workstreams.
From February 2027 onward, the project expects to focus increasingly on amplification and global adoption of its deliverables.
Foundations Workstream
The OWASP AIBOM Foundations Guide v1.0 has been released, marking a major project milestone.
The guide is available in English, Spanish, and German, expanding access for the international AI security community.
Contributors were recognized for supporting the translation efforts.
The guide provides foundational guidance on documenting AI components, dependencies, and related supply chain information.
Following the major release, the Foundations workstream paused its regular meetings temporarily.
Meetings are scheduled to resume on November 2, 2026, transitioning from weekly to biweekly.
Published resources are available through the OWASP AIBOM website’s Whitepapers section.
Policy and Regulatory Guidance
The Policy workstream has resumed regular meetings and continues developing practical regulatory guidance.
Recent activities include mapping relevant requirements from the EU AI Act to AIBOM concepts and documentation practices.
The team is focusing on making regulatory requirements easier for industry practitioners to interpret and apply.
Discussions include identifying relevant controls, expected documentation, and supporting evidence organizations may need.
An AI regulation tracker is being maintained, covering regulations and non-regulatory frameworks across jurisdictions and industries.
The team is exploring publication of the tracker as an interactive website resource to help users identify relevant requirements.
Additional contributors are being welcomed into the workstream.
Threat Intelligence and Agentic BOM (AgBOM)
The Threat Intelligence workstream is coordinating with Foundations and AgBOM because its future mapping activities depend on their foundational outputs.
Work continues on the AgBOM 101 guidance, which will address the components and dependencies of agentic AI systems.
An initial AgBOM draft is targeted for completion by the end of October 2026, followed by contributor review.
The team discussed aligning the Foundations and AgBOM documentation to establish a common foundation for future Threat Intelligence work.
Threat Intelligence meetings are temporarily on hold while the supporting documentation progresses.
The project also discussed potential collaboration with another OWASP initiative developing an Agent Control Standard.
The proposed collaboration could help connect agent component visibility and documentation with actionable controls and operational guidance.
Integrity and Quality Workstream
The newly active Integrity and Quality workstream, led by Sapna with contributions from Matthew, held its first working meeting.
Matthew demonstrated an initial AIBOM integrity checker application incorporating validation logic and preliminary tests.
The team reviewed early results and identified the need for additional testing across more models and use cases.
The proposed tool aims to help users assess the integrity, completeness, and quality of generated AIBOMs.
Discussions included exploring digital signatures and signatory information to strengthen trust and verification.
The workstream plans to contribute the checker code to the OWASP AIBOM GitHub repository.
A supporting integrity and quality guidance document is also planned to describe validation checks and considerations when reviewing an AIBOM.
Further pilot testing, documentation, and validation will be required before the tool is ready for broader use.
Content, Community Growth, and Engagement
OWASP AIBOM celebrated reaching more than 500 LinkedIn followers, with the audience continuing to grow beyond the milestone during the meeting.
Contributors, sponsors, collaborators, and the broader AI security community were recognized for supporting project awareness and engagement.
A recent contribution to the OWASP AI Exchange project referenced OWASP AIBOM and its foundational guidance, creating an opportunity for closer collaboration.
The Content and Engagement workstream highlighted continued educational activities through blogs, LinkedIn Live sessions, and recordings available on YouTube.
Recent content included an analysis of the Plugin4Shell vulnerability.
An upcoming OWASP AIBOM × Codacy LinkedIn Live, scheduled for October 21, will discuss Shadow AI in Your Codebase and connect the topic to Cybersecurity Awareness Month.
The project continues expanding educational resources and maintaining its online publications.
Conferences and Industry Events
OWASP AIBOM reviewed recent participation in industry conferences and community events.
At the Midwest AI Summit 2026 in Indianapolis, OWASP AIBOM participated as a Gold Sponsor, with representation alongside collaborator Prediction Guard.
The event provided opportunities to discuss AIBOM, AI technology, and supply chain visibility with attendees from multiple industries.
Prediction Guard’s AI Engineering Lounge offered participants opportunities for direct technical discussions and demonstrations.
The team also highlighted participation in SEMICON and other technology-focused industry events.
Upcoming conference activities in Budapest were noted, with project contributors preparing to present.
Conference participation continues to support engagement, awareness, and relationships across the AI security ecosystem.
Academic Collaboration and Sponsorship
Discussions are progressing with academic institutions, including the University of South Florida (USF) and an Indian Institute of Technology (IIT).
Additional collaboration opportunities are being explored with universities in New York and Washington.
The goal is to connect OWASP AIBOM’s practical guidance and industry participation with academic research.
Further details will be shared as collaboration arrangements become formalized.
Sponsorship discussions remain active with existing and prospective industry partners.
The project’s 2026 sponsorship goal remains $100,000, intended to support contributor participation, conferences, travel, and community activities.
Organizations interested in contributing or sponsoring were encouraged to explore the project’s public sponsorship information.
Industry Questions and Technical Discussion
The open discussion highlighted several practical challenges organizations face when implementing AI Bills of Materials.
Vendor standardization and AIBOM quality
An industry participant raised concerns about significant differences in the content and quality of AIBOMs generated by commercial vendors.
The discussion emphasized the current lack of uniformity between vendor approaches and implementations.
Project representatives explained that OWASP AIBOM is focusing on operational guidance, validity, and the practical use of generated inventories.
Further technical alignment and collaboration with industry practitioners were encouraged.
Third-party AI systems and agent visibility
Participants asked how organizations can verify AI components obtained through third-party services, including models, training-data information, and voice-based AI systems.
Additional questions addressed how to identify and categorize agents operating within orchestration frameworks.
The team explained that the Foundations and AgBOM workstreams aim to provide guidance on documenting these components and their relationships.
Discussion also highlighted the importance of inventory tools that can distinguish models, agents, and orchestration components.
These capabilities remain areas of ongoing development and standardization rather than completed solutions.
Community contributions
New participants expressed interest in contributing to Policy, Integrity and Quality, and other technical workstreams.
Contributors were encouraged to share technical questions through the project’s Slack channels for more detailed follow-up.
The team also directed new members to the OWASP AIBOM website for workstream information, publications, and contribution opportunities.
Final Remarks
OWASP AIBOM continues progressing through Phase 3, with major foundational publications completed and additional workstream deliverables underway.
The multilingual Foundations Guide v1.0 represents an important step toward wider accessibility and community adoption.
Policy, AgBOM, Threat Intelligence, and Integrity and Quality activities continue developing toward practical guidance and validation capabilities.
Growing community engagement, industry participation, and academic collaboration are creating new opportunities to strengthen the project’s work.
Discussions on vendor consistency, component verification, and agent visibility reinforced the need for reliable and actionable AI supply chain documentation.
Contributors were encouraged to participate through the OWASP AIBOM website, Slack community, and project workstreams.
Project Resources
Website: https://owaspaibom.org
Whitepapers: https://owaspaibom.org/whitepapers/
Meeting Summaries: https://owaspaibom.org/category/mom/
