Taiwan Health Ministry Advances SBOM Framework for Medical AI Software and Healthcare Sovereign Cloud

Medical AI systems comprise more than models. They also rely on inference frameworks, third-party libraries, container images and APIs, and a vulnerability in any component could provide an entry point for attackers. Taiwan's Ministry of Health and Welfare is therefore incorporating software bills of materials, or SBOMs, into its governance framework and using FHIR to standardize data across hospitals, supporting AI training and data interoperability while safeguarding sovereignty over healthcare data.

On May 6, 2026, Lee Chien-chang, director-general of the ministry's Department of Information Management, told the CYBERSEC conference in Taiwan that responsible AI centers operating at 10 hospitals would introduce SBOMs, vulnerability scanning and independent reviews. The ministry also plans to publish eight healthcare sovereign-cloud guidelines coordinated with Microsoft, Google Cloud and AWS. Hospitals are estimated to face a 5% to 15% cost increase when using public cloud services.