I’m Gareth Richards, AI Network Manager at TechWorks and I delivered these opening remarks at the TechWorks AI event held at Kellogg College, University of Oxford. In this piece, I want to share why UK businesses must start taking Software Bills of Materials (SBOMs) seriously, especially as regulatory pressure builds in the United States and the European Union, and how the Trustable AI Bill of Materials (TAIBOM) project is helping define a broader approach to AI system integrity. (note this event predates the launch of TechWorks-AI)

Why SBOMs are now a business imperative

SBOMs are no longer an optional piece of housekeeping for software teams. They are becoming a core requirement for demonstrating system integrity, supply-chain transparency and cyber resilience. With regulators in the US and EU moving quickly to demand stronger provenance and traceability, UK businesses need to begin planning SBOM adoption now.

“We need to start thinking seriously about SBOMs and how you implement them.”

That urgency isn’t just compliance-driven. SBOMs give organisations a clearer view of the components that make up their systems, which is critical for vulnerability management, incident response and for building trust in AI-driven products and services.

What TechWorks does and why it matters

TechWorks is a not‑for‑profit industry association focused on encouraging and facilitating innovation and collaboration across the deep tech ecosystem. Our mission is to help the UK build on, and enhance, its reputation as a leading location to start and scale deep tech businesses.

Our role and activities

• Cross-industry collaboration and thought leadership
• Sector analysis and horizon scanning for standards and regulation
• Research strategy, advocacy and project delivery
• Influencing standards and best practice development

Within TechWorks we run four pillar communities and a number of Special Interest groups and projects. These communities bring together leaders in innovation, engineering, product and business—helping us to both inform government and to translate standards development into practical, usable guidance for members.

Our four pillar communities

• DESN: semiconductor design (design tools, verification, silicon IP)
• NMI: silicon manufacture (fabrication, packaging, test)
• AESIN: automotive electronics and related applications (EVs, autonomy, cross-industry reuse)
• IoT Security Foundation: product-focused cybersecurity and broader cyber practice

These communities interact, form special interest groups (for example, automotive electronics), and contribute to cross-cutting projects such as TAIBOM.

The Trustable AI Bill of Materials (TAIBOM) project

TAIBOM is a UKRI-funded project that extends the concept of an SBOM into the AI space: it covers software components but also addresses data provenance, training data integrity, and the cybersecurity of inferencing systems. The goal is to produce a practical framework that supports trustworthy AI across industry.

What TAIBOM covers

• Software Bill of Materials (SBOM) for code and dependencies
• Data provenance and lineage: what data was used to train models?
• Data integrity: assessing and documenting the quality of training datasets
• Inferencing system security: how models are deployed and protected at inference time

Project partners

• Nquiring Minds
• Copper Horse
• University of Oxford
• BSI (British Standards Institution)
• BAE Systems
• TechWorks as industry intermediary and contributor

TechWorks contributes by bringing our membership’s practical experience into the project, through working groups, critique and guidance, ensuring the outputs are relevant to a wide range of deep-tech organisations.

How TechWorks members feed into standards and practice

Our membership includes leading companies across the stack – chip designers, manufacturers, automotive electronics and cybersecurity practitioners. Examples include ARM, NXP, and others who regularly engage in our working groups and projects.

Through these groups we surface real-world requirements, test proposed approaches and feed back into standards development organisations like BSI. That two‑way connection helps ensure standards are implementable and aligned with business needs.

Practical steps for UK businesses

If you’re responsible for technology, product or compliance, here are sensible next steps:

1. Start inventorying your software components and dependencies & begin building SBOMs now rather than waiting for regulation.
2. Map data flows and document data provenance for training and validation sets.
3. Assess inferencing security: how are models served, who can access them, and how are inputs and outputs protected?
4. Engage with industry groups and standards bodies to help shape practical guidance – participation speeds adoption and influence.
5. Look for collaborative projects (like TAIBOM) that can provide frameworks and tools you can adopt early.

Conclusion

SBOMs are a foundational element for system integrity, but for AI we need to go further – documenting data provenance, ensuring data integrity and securing inferencing pipelines. Regulatory pressure from the US and EU makes this a priority for UK businesses, not just a best practice.

At TechWorks we aim to convene expertise across AI, semiconductor design, manufacturing, automotive electronics and IoT security so that the UK’s deep tech ecosystem can respond to these challenges coherently and competitively. If you’re building or deploying AI systems, now is the time to get serious about SBOMs and to engage in collaborative initiatives like TAIBOM that are shaping what “trustable AI” will mean in practice.

If you want to get involved or learn more, join our working groups and upcoming events—practical guidance and peer input will make implementation far more achievable.