AI Agent Package Representation

[morita225]

[File URL / Relevant Section Number]
https://github.com/OpenChain-Project/SBOM-wg/blob/main/Cross-Industry-SBOM-Quality-Guide/en/chapters/05-common-sbom-document-quality-issues-and-improvement-measures.md

[Previous Text]
5.1.3 Improvement Measures

[Subject Text]
The SBOM Document shall include the items documented in "3.2 SBOM Elements - Package information, Information that can uniquely identify a software package”, ensuring their consistent use throughout the entire supply chain.

[Following Text]
Additionally, since the identifiers used to uniquely identify a package may differ depending on the entity distributing the SBOM Document, it is necessary to also provide information on which combination of elements and corresponding values should be used to accurately identify the software package.

[Comments / Suggested Changes]
How is an AI Agent package represented?

[Comments from]
Karen Bennet

[Dates]
2026-04-29

[NorioKobota]

It is not clear what is meant by an “AI Agent package” in this context.

If this refers to whether a package contains AI-generated code, we consider that out of scope. SBOM quality should be evaluated based on the information necessary for license compliance, security, and software transparency, regardless of how the code was produced.

If this refers to AI-specific provenance information, such as the type of LLM or agent architecture, we believe this is an important but still evolving area. We consider AI-specific SBOM quality requirements to be outside the scope of the current guide and a topic for future discussion.