FDA-Compliant SBOM for Imaging AI & SaMD

SaMD products - especially imaging AI - have the messiest software bills of materials in MedTech: a Python ML stack with hundreds of transitive deps, container base layers, CUDA/cuDNN binaries, DICOM toolkits, model weights treated as code, and frequently a JS/TS frontend on top. A naive pip-freeze SBOM fails reviewer scrutiny because it under-reports OS-level components and doesn't describe the inference runtime or model provenance. Our SBOM service for this segment produces what FDA actually wants under Section 524B: a complete, layered SBOM that includes the OS, the runtime, the Python deps with resolved versions, the model artifacts, and a VEX (Vulnerability Exploitability eXchange) document that explains why high-severity CVEs in your stack are or are not exploitable in your specific deployment.

This matters because the imaging-AI stack is full of high-CVSS Python and CUDA CVEs that are not exploitable in your container - and unless you say so explicitly with a VEX, your reviewer assumes the worst. We generate CycloneDX 1.5 / SPDX 2.3 SBOMs from the build pipeline (not from runtime introspection alone), enrich them with NVD/OSV/GHSA data, triage every CVE above your defined threshold, and produce VEX statements with the four FDA-relevant statuses: not_affected, affected, fixed, under_investigation. We also document model provenance: training data lineage at the level FDA expects, weight file hashes, and the model-card link - because reviewers increasingly treat the model itself as a SBOM component.