Software bill of materials (SBOM) strategies are rapidly evolving. What began as a way to track open source components for compliance and vulnerability management is quickly expanding into something much larger: a broader effort to understand, secure, and govern modern software supply chains.
At the same time, organizations are increasingly adopting AI-powered applications and exploring Artificial Intelligence Bills of Materials (AI BOMs) — which extend software transparency practices to AI systems, datasets, models, and decision logic.
The challenge is that modern software ecosystems are far more complex than traditional package inventories alone.
Applications today depend on:
-
Cloud services
-
APIs
-
Containers
-
Build systems
-
CI/CD pipelines
-
AI/ML models
-
Deployment infrastructure
-
Security attestations and provenance data
Traditional SBOM models were never designed to represent this level of complexity.
That's exactly why SPDX 3.0 matters. It gives organizations a more flexible, extensible way to describe software, security, build, dataset, and AI-related metadata as part of a broader supply chain transparency strategy. And it's why Sonatype SBOM Manager now supports SPDX 3.0.
SBOMs Are Growing Beyond Package Inventories
Historically, most SBOMs focused on answering a single question: "What components are included in this application?"
That was an important first step for software transparency.
But organizations today increasingly need answers to much larger questions:
-
How was this software built?
-
What services does it depend on?
-
What relationships exist between artifacts?
-
What AI models are embedded?
-
What evidence proves integrity and provenance?
-
How does software move through the development lifecycle?
Traditional SBOM formats weren't designed to model this level of complexity. SPDX 3.0 addresses these emerging requirements by extending software transparency beyond package inventories and creating a foundation for both SBOM and AI BOM initiatives.
SPDX 3.0 Reduces Operational Complexity
One of the most practical advantages of SPDX 3.0 is that it simplifies how organizations manage software transparency data.
In earlier SPDX versions, VEX (Vulnerability Exploitability eXchange) information typically existed as a separate document that lived alongside the SBOM itself.
That created additional operational overhead such as more files to manage, more artifacts to track, more opportunity for version drift, and more complexity during audits or investigations.
SPDX 3.0 changes this model by allowing VEX information to be embedded directly within the SBOM.
Instead of managing multiple disconnected artifacts, organizations can maintain a more complete and unified software transparency record in a single document.
This creates several advantages:
-
Fewer documents to track and maintain.
-
Reduced management overhead.
-
Improved consistency between SBOM and vulnerability context.
-
Lower risk of operational errors.
-
Simpler downstream automation and governance workflows.
For enterprises managing thousands of applications and software artifacts, this consolidation can significantly streamline SBOM operations.
Why This Matters for Enterprises
For many organizations, software transparency requirements are accelerating faster than their tooling strategies.
Security teams are facing increased pressure around:
-
Supply chain attacks
-
Provenance verification
-
Regulatory compliance
-
Vendor risk management
-
Open source governance
-
Software integrity validation
-
AI risk management and auditability
At the same time, modern development environments are becoming increasingly distributed and dynamic.
Organizations need more than visibility into components. They need context. SPDX 3.0 helps provide that context by enabling richer representations of software relationships, provenance, security data, and emerging AI BOM metadata within a unified framework.
SPDX 3.0 Expands SBOMs into AI BOM Transparency
Another major evolution in SPDX 3.0 is support for AI and machine learning systems.
Earlier SBOM standards were not designed to represent AI-specific metadata in meaningful ways. As organizations increasingly adopt AI-powered applications and embedded models, that limitation becomes more significant.
SPDX 3.0 introduces support for AI-related metadata such as:
-
Hyperparameters
-
Fine-tuning information
-
Dataset references
-
Explainability metadata
-
Decision thresholds
-
Energy consumption metrics
This represents an important shift.
Organizations increasingly need visibility not just into which AI components are being used, but how they are being used, trained, tuned, and operationalized.
The level of transparency in AI BOMs is becoming increasingly important for AI governance, regulatory readiness, model risk management, responsible AI initiatives, and enterprise auditability. SPDX 3.0 gives organizations a path to bring AI systems into the same governance conversations already happening around software supply chain security.
"What's Inside?" to "How Does It All Connect?"
This is the fundamental shift enabled by SPDX 3.0.
-
Before: SBOMs answered, "What packages are present?"
-
Now: Organizations can understand how software systems are connected. This richer context strengthens incident response, provenance validation, audit readiness, governance, zero-trust initiatives, and AI transparency.
What SPDX 3.0 Means for Sonatype SBOM Manager
With SPDX 3.0 support, Sonatype SBOM Manager evolves beyond centralized SBOM ingestion and governance. It becomes a platform for operationalizing software supply chain intelligence.
Organizations can now begin managing richer software metadata across:
-
Development pipelines
-
Security workflows
-
Compliance processes
-
Vendor ecosystems
-
Software lifecycle governance initiatives
Importantly, this does not require abandoning existing SBOM investments.
Most enterprises will continue operating in heterogeneous environments with multiple standards and formats. Sonatype SBOM Manager helps normalize and operationalize those workflows while enabling organizations to prepare for the future of software transparency.
Why Organizations Should Start Preparing Now
SPDX 3.0 adoption will not happen overnight. But the direction of the industry is becoming increasingly clear. Software supply chain security is moving toward:
-
Richer provenance
-
Stronger attestations
-
Lifecycle traceability
-
Interoperable metadata ecosystems
-
Broader artifact representation
-
Evolving compliance requirements
The Next Step for SBOM and AI BOM Readiness
By supporting SPDX 3.0, Sonatype SBOM Manager helps organizations prepare for that next phase, which enables richer interoperability, deeper lifecycle visibility, and future-ready software supply chain intelligence.
As SBOMs expand to include AI systems, datasets, provenance, security evidence, and more complex relationships, organizations need tools that can help them manage that complexity without slowing development. Sonatype SBOM Manager gives teams a practical foundation for doing exactly that.
Andrew Garrett is a Product Marketer at Sonatype who helps tell the story of secure software supply chains. Working closely with sales, product, and marketing teams, he highlights how organizations can reduce risk and accelerate development with better software supply chain management. With a decade of cybersecurity experience, Andrew enjoys translating complex security challenges into compelling stories that resonate with business and technology leaders.
Tags
Generate a SBOM for Rich Insights
Get actionable insights by generating a free software bill of materials (SBOM) powered by Sonatype SBOM Manager.