What contract terms turn a supplier's promise of an SBOM into an enforceable obligation?

## Why goodwill clauses fail Most supplier agreements that mention a bill of materials say something like *Supplier shall provide a software bill of materials upon reasonable request*. Nothing there is testable. There is no format, no deadline, no definition of which artifact, and no consequence — so the clause survives every audit while producing nothing operational. When a critical advisory lands at 09:00 and you email the account manager, `reasonable request` is worth exactly as much as the account manager's calendar. An enforceable obligation has to answer: **what**, **when**, **triggered by what**, **what may I do with it**, and **what happens if it does not arrive**. ## The five elements ### 1. Artifact and format Name the deliverable — this product, this image, this firmware family — and require a **machine-readable** document in a standard format (SPDX or CycloneDX). This matters more than it sounds: a vendor that delivers a PDF appendix of component names has technically complied and given you nothing you can query. Specify identifiers too, so components carry versions and, where the ecosystem supports it, a package URL rather than a marketing name. ### 2. Scope and cadence Require one document **per released version**, not per major release, and require it to be tied to the artifact you actually deploy — a version plus digest, so the document can be matched back later. A vendor portal that always exposes only `latest` fails this: if you are two releases behind, the portal describes something you do not run and you cannot retrieve the document for the build you do. ### 3. Trigger and deadline A calendar cadence alone — quarterly, annually — leaves a blind window as long as the interval, and produces documents nobody opens. Better is an **event trigger with a counted deadline**: a refreshed document within a small number of business days when a newly published advisory affects a listed component, plus delivery on demand during a declared incident. A calendar floor can sit underneath that for slow-moving products. ### 4. Use rights, and the NDA trap The clause that quietly destroys the control is a confidentiality term permitting you to *view* the document but not to store it. If you cannot retain it, load it into your own inventory store and query it when an advisory lands, you do not have a control; you have a meeting. Negotiate confidentiality that explicitly permits internal storage, use in your own tooling, and disclosure to auditors and regulators under equivalent confidentiality. A supplier who refuses all of that is telling you the document is a sales artifact. ### 5. Consequences An obligation with no remedy is a preference. Options, in ascending severity: a cure period, a right to escalate to a named executive, an audit right, service credits, withheld payment, and — for the most critical suppliers — termination for repeated failure. You will rarely exercise these. Their function is to make the delivery date real inside the vendor's own organisation, because now someone there owns a contractual date rather than a favour. ## Two clauses worth adding - **Flow-down.** If your supplier assembles its product from other vendors' components, an obligation that stops at their own code leaves their embedded third-party stack opaque. Require that sub-supplier components are covered, or that the supplier explicitly names where its own visibility ends. - **Survival and retention.** You will need the document for the build you ran after the contract ends — during an incident investigation, or when an advisory lands about something you deployed two years ago. Say that your retained copies survive termination. ## Leverage and timing These terms are negotiated, not declared. The moment you have leverage is **procurement or renewal**, when money is not yet committed; a mid-term request to a payroll SaaS vendor that holds personal data for your whole workforce moves nothing, because they have already been paid and you are not switching payroll providers this quarter. Put the clause into the standard template so it is the default position rather than a special demand, and reserve negotiation effort for suppliers where it matters. One more caution: an obligation you never check is the same as no obligation. Whoever owns supplier management needs a way to notice that the last three releases arrived without documents, or the clause becomes decoration alongside the goodwill version it replaced.