Linux Foundation Releases OpenChain Automotive SBOM Framework 1.0 for Greater Reliability and Traceability in Automotive Software

New open framework drives industry-wide alignment on SBOM practices in light of increasing regulatory and cybersecurity requirements within automotive ecosystem

PRAGUE, Oct. 7, 2026 /PRNewswire/ -- Open Source Summit Europe – The Linux Foundation, the nonprofit organization enabling mass innovation through open source, today announced the release of the OpenChain Automotive Software Bill of Materials (SBOM) Framework 1.0, an open framework that defines a common approach for creating and sharing high-quality SBOMs tailored to the automotive industry.

As software becomes increasingly critical to modern vehicles, organizations are under growing pressure to improve visibility into software components and dependencies while meeting evolving regulatory and cybersecurity requirements. The OpenChain Automotive SBOM Framework provides a practical baseline that can be adopted and refined across the industry in order to meet these challenges facing the automotive industry.

Key elements of the framework include:

• A defined structure for describing software components and dependencies in Automotive SBOMs
• Guidance on required and recommended data fields, including completeness and quality criteria
• Alignment with existing SBOM standards such as SPDX (ISO/IEC 5962)
• Usage scenarios for suppliers and OEMs, including data exchange across the automotive supply chain

The framework provides guidance on how software component information should be described and exchanged using established formats, enabling suppliers and OEMs to produce SBOMs that meet shared expectations for completeness, consistency, and usability. It is designed to support practical use cases including software transparency, supply chain communication, and regulatory readiness.

"As software-defined vehicles grow in complexity, improving transparency and traceability across software components is becoming essential," said Mary Meixia Wang, General Manager of the OpenChain Project. "This first release provides practical guidance and helps advance more consistent SBOM practices across the automotive ecosystem."

The initiative began with early discussions between Keisuke Takase (Toyota), Ayumi Watanabe (Hitachi Solutions, Ltd.), and Masato Endo (Chair, OpenChain Automotive Working Group), reflecting a shared commitment to improving software transparency, traceability, and productivity in the automotive industry. It has since grown through collaboration with organizations, industry associations, and subject matter experts across the automotive and software ecosystems. Their input helped identify common challenges and shape a practical, broadly applicable framework grounded in real-world needs and emerging industry expectations.

The Automotive SBOM Project is part of the OpenChain Automotive Working Group and is designed to complement existing standards such as SPDX (ISO/IEC 5962). The framework does not replace these standards, but instead provides guidance on how they can be applied consistently within the automotive industry.

The project is open to participation from organizations and individuals worldwide and will continue to evolve based on industry feedback and adoption. To learn more about the OpenChain Project and visit the website or access the OpenChain Automotive SBOM Framework, here.

Supporting Quotes

"The release of the OpenChain Automotive SBOM Framework marks a significant milestone for the automotive industry. By establishing a common approach to creating and sharing high-quality, trustworthy SBOM data, this framework enhances transparency and trust across the entire supply chain. We believe its adoption will help improve supply chain reliability and contribute to greater engineering productivity and innovation across the automotive industry."
– Jiro Watabe, Senior Vice President and Executive Officer, Hitachi Solutions, Ltd.

"As the scale and complexity of automotive software development continue to grow with the advancement of software-defined vehicles, sharing reliable SBOM information across the supply chain is becoming increasingly important. We expect the OpenChain Automotive SBOM Framework to enable the industry to openly share effective processes and best practices, helping create an environment where engineers can focus more of their time and expertise on delivering value to customers."
– Hirofumi Inoue, President of Advanced R&D and Engineering Company, Toyota Motor Corporation

"Effective use of SBOMs is more than just generating or publishing them on-demand. Differing requirements and expectations between organizations and regulators open the door to SBOM quality issues – something that a shared framework and clear guidance on structures and data quality helps resolve at scale."
– Tim Mackey, Head of Software Supply Chain Risk Strategy, Black Duck Software, Inc.

"The Automotive SBOM gives the industry a much-needed common format for improving software supply chain transparency. FossID is excited to support it by helping automotive teams generate, import, translate, and validate SBOMs according to the new standard. Reliably automating the process is one way we plan to help accelerate the use of the Automotive SBOM across manufacturers and their supplier ecosystems."
– Stuart Dross, CEO, FossID

"As vehicle development becomes increasingly software-centric, including through the advancement of software-defined vehicles, visibility into software composition is becoming an important area of focus. Through its participation in this initiative toward SBOM standardization, Nissan will contribute to the development of a common foundation for the industry."
– Sugimoto Kazma, General Manager, Software Platform and Architecture Engineering Department, Software Defined Vehicle Engineering Division, Nissan Motor Co., Ltd.

"Volvo Cars has embedded SBOM practices into its vehicle development processes through our 'Continuous SBOM' program launched last year. By promoting a common approach across the supply chain, we can improve transparency and collaboration for us all while helping drive the evolution of Automotive SBOMs from license compliance and cybersecurity artifacts to become a foundation for software trust, provenance, safety, lifecycle governance, and supply chain intelligence."
– Carl-Eric Mols, Global Open Source Strategy Lead, Volvo Cars

About the OpenChain Project
The OpenChain Project, hosted by the Linux Foundation, focuses on building trust in the open source supply chain. It develops open standards for open source compliance and security, helping organizations manage software licensing and risk across global ecosystems.

About the Linux Foundation
The Linux Foundation is the world's leading home for collaboration on open source software, hardware, standards, and data. Linux Foundation projects, including Linux, Kubernetes, Model Context Protocol (MCP), OpenChain, OpenSearch, OpenSSF, OpenStack, PyTorch, Ray, RISC-V, SPDX and Zephyr, provide the foundation for global infrastructure. The Linux Foundation is focused on leveraging best practices and addressing the needs of contributors, users, and solution providers to create sustainable models for open collaboration. For more information, please visit us at linuxfoundation.org.

The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see its trademark usage page: www.linuxfoundation.org/trademark-usage. Linux is a registered trademark of Linus Torvalds.

Media Contact
The Linux Foundation
[email protected]

SOURCE The Linux Foundation