Traceability obligations missing

[NorioKobota]

[File URL / Relevant Section Number]
https://github.com/OpenChain-Project/SBOM-wg/blob/main/Cross-Industry-SBOM-Quality-Guide/en/chapters/06-compliance-elements-for-spdx-and-cyclonedx-in-relation-to-legislation-and-guidelines.md

[Subject Text]
Need to add in Chapter 6?

[Comments / Suggested Changes]
China's Cybersecurity Law and associated regulations impose SBOM-aligned traceability obligations on critical infrastructure operators and are not addressed in the guide.

[Comments from]
Ibrahim Haddad

[Dates]
2026-04-07

[NorioKobota]

We agree that relevant Chinese cybersecurity regulations may merit consideration in this guide. While they are not currently included in the scope of this version, we will consider adding them in a future revision as we continue to expand the regulatory references covered by the guide.