v3.1.0: AI supply-chain disclosure block (G7 SBOM-for-AI)

Adds three backward-compatible fields covering the G7 / BSI / ACN / CISA
"SBOM for AI - Minimum Elements" guideline published on 12 May 2026:

- profile.usesAiSystems (boolean, required) - gates the AI block.
  Includes any AI / ML model the customer's data passes through,
  including third-party LLMs accessed via API.
- security_practices.providesSbomForAi (boolean, optional,
  visibleWhen usesAiSystems=true) - supplier states whether they
  publish an SBOM-for-AI per the G7 minimum elements.
- security_practices.aiSbomUrl (url, optional, visibleWhen
  providesSbomForAi=true) - public or customer-shared URL.

Legal basis: NIS2 Art. 21(2)(d) / ENISA TIG §5.1.2. The G7 SBOM-for-AI
guideline is referenced in field descriptions as the recognised
voluntary baseline, not as the legal authority - the underlying duty
is supply-chain risk management; the G7 document operationalises one
credible disclosure format.

No schema enum changes, no breaking changes. Existing supplier
responses remain valid; new fields default to null until answered.
The visibleFields helper hides the entire AI block from suppliers
that don't use AI systems.

Field count: 56 -> 59.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: simonorzel26

CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to this repository are documented here. Format follows [Keep
 
 ## [Unreleased]
 
+## [3.1.0] — 2026-05-15
+
+### Added
+- **AI supply-chain disclosure block.** Three new fields covering the G7 / BSI / ACN / CISA "Software Bill of Materials (SBOM) for Artificial Intelligence — Minimum Elements" guideline published on 12 May 2026:
+  - `profile.usesAiSystems` (boolean, required) — gates the AI block. Includes any AI / ML model the customer's data passes through, including third-party LLMs accessed via API.
+  - `security_practices.providesSbomForAi` (boolean, optional, visible when `usesAiSystems = true`) — supplier states whether they publish an SBOM-for-AI per the G7 minimum elements.
+  - `security_practices.aiSbomUrl` (url, optional, visible when `providesSbomForAi = true`) — public or customer-shared URL to the document.
+- Legal basis anchored to **NIS2 Art. 21(2)(d) / ENISA TIG §5.1.2**. The G7 SBOM-for-AI guideline is referenced in the description as the recognised voluntary baseline, not as the legal authority — the underlying duty is supply-chain risk management; the G7 document operationalises one credible disclosure format.
+
+### Migration
+- Backward compatible. Existing supplier responses remain valid; new fields default to `null` until a supplier answers them. The `usesAiSystems` gate hides the entire AI block from suppliers that don't use AI.
+- Consumers do not need to change anything. The visible-fields helper automatically skips the new conditional block based on the response state.
+
 ## [3.0.1] — 2026-04-28
 
 ### Changed

README.md

@@ -15,7 +15,7 @@ The reference implementation is the supplier portal at [nisd2.eu](https://nisd2.
 
 ## What's in it
 
-- **56 fields** across 6 sections (`profile`, `security_practices`, `saas_technical`, `on_prem_technical`, `pro_services`, `managed_services`)
+- **59 fields** across 6 sections (`profile`, `security_practices`, `saas_technical`, `on_prem_technical`, `pro_services`, `managed_services`)
 - Each field anchored to an **EU-level** primary source: NIS2 Art. 21(2), CIR 2024/2690, ENISA Technical Implementation Guidance v1.0, GDPR Art. 28, or the Cyber Resilience Act
 - Two locales: English and German
 - Published as a Zod schema (TypeScript), a JSON artefact, and a JSON Schema for non-TS consumers
@@ -36,7 +36,7 @@ National-derivative frameworks (BSI IT-Grundschutz / Lieferketten-Checkliste in
 This package is **not on the npm registry** — install directly from GitHub.
 
 ```bash
-bun add github:NISD2/nis2-supply-chain-questionnaire-schema#v3.0.2
+bun add github:NISD2/nis2-supply-chain-questionnaire-schema#v3.1.0
 # npm, pnpm, yarn — same syntax
 ```
 

data/supply-chain-questionnaire.json

@@ -1,6 +1,6 @@
 {
-  "version": "3.0.2",
-  "lastUpdated": "2026-04-28",
+  "version": "3.1.0",
+  "lastUpdated": "2026-05-15",
   "fields": [
     {
       "id": "legalName",
@@ -257,6 +257,21 @@
       "legalBasis": "ENISA TIG §5.2(b)",
       "required": true
     },
+    {
+      "id": "usesAiSystems",
+      "section": "profile",
+      "type": "boolean",
+      "label": {
+        "en": "We use, integrate or provide AI systems",
+        "de": "Wir nutzen, integrieren oder bieten KI-Systeme"
+      },
+      "description": {
+        "en": "Determines whether AI supply-chain disclosure questions appear next. Includes any AI / ML model the customer's data passes through, including third-party LLMs accessed via API.",
+        "de": "Bestimmt, ob KI-Lieferketten-Fragen als Nächstes erscheinen. Schließt jedes KI- / ML-Modell ein, durch das Kundendaten laufen — auch fremde LLMs über API."
+      },
+      "legalBasis": "NIS2 Art. 21(2)(d)",
+      "required": true
+    },
     {
       "id": "hasIsms",
       "section": "security_practices",
@@ -621,6 +636,44 @@
       "legalBasis": "ENISA TIG §5.1.4 TIPS",
       "required": true
     },
+    {
+      "id": "providesSbomForAi",
+      "section": "security_practices",
+      "type": "boolean",
+      "label": {
+        "en": "Provide an SBOM-for-AI per G7 minimum elements",
+        "de": "Wir stellen ein SBOM-for-AI nach G7-Mindestelementen bereit"
+      },
+      "description": {
+        "en": "G7 cybersecurity authorities (BSI, ACN, CISA et al.) and the EU Commission published 'Software Bill of Materials (SBOM) for Artificial Intelligence — Minimum Elements' on 12 May 2026. Voluntary baseline reference for AI supply-chain transparency under NIS2 Art. 21(2)(d). Covers seven clusters: metadata, models, dataset properties, infrastructure, security properties, KPIs, system-level properties.",
+        "de": "G7-Cybersicherheitsbehörden (BSI, ACN, CISA u. a.) und die EU-Kommission haben am 12. Mai 2026 'Software Bill of Materials (SBOM) for Artificial Intelligence — Minimum Elements' veröffentlicht. Freiwillige Baseline-Referenz für KI-Lieferketten-Transparenz nach NIS2 Art. 21(2)(d). Umfasst sieben Cluster: Metadata, Models, Dataset Properties, Infrastructure, Security Properties, KPIs, System-Level Properties."
+      },
+      "legalBasis": "NIS2 Art. 21(2)(d) / ENISA TIG §5.1.2",
+      "required": false,
+      "visibleWhen": {
+        "field": "usesAiSystems",
+        "equals": true
+      }
+    },
+    {
+      "id": "aiSbomUrl",
+      "section": "security_practices",
+      "type": "url",
+      "label": {
+        "en": "SBOM-for-AI document URL",
+        "de": "URL des SBOM-for-AI-Dokuments"
+      },
+      "description": {
+        "en": "Public or customer-shared URL pointing to the supplier's SBOM-for-AI document.",
+        "de": "Öffentliche oder kundenseitig geteilte URL zum SBOM-for-AI-Dokument des Lieferanten."
+      },
+      "legalBasis": "NIS2 Art. 21(2)(d) / ENISA TIG §5.1.2",
+      "required": false,
+      "visibleWhen": {
+        "field": "providesSbomForAi",
+        "equals": true
+      }
+    },
     {
       "id": "saasHostingRegion",
       "section": "saas_technical",

dist/data.d.ts

@@ -8,8 +8,8 @@ import { type SupplierQuestionnaire } from "./schema";
  * Bump these constants when shipping a release; CI will fail if the
  * generated JSON falls out of sync.
  */
-export declare const VERSION = "3.0.2";
-export declare const LAST_UPDATED = "2026-04-28";
+export declare const VERSION = "3.1.0";
+export declare const LAST_UPDATED = "2026-05-15";
 export declare const supplierQuestionnaire: SupplierQuestionnaire;
 export declare function groupBySection(q: SupplierQuestionnaire): Map<string, {
     type: "string" | "boolean" | "text" | "email" | "phone" | "url" | "country" | "enum" | "integer";