Enum ComplianceLevel 

#[non_exhaustive]
pub enum ComplianceLevel {
    Minimum,
    Standard,
    NtiaMinimum,
    CraPhase1,
    CraPhase2,
    FdaMedicalDevice,
    NistSsdf,
    Eo14028,
    Cnsa2,
    NistPqc,
    BsiTr03183_2,
    CraOssSteward,
    EuccSubstantial,
    EuAiAct,
    BsiSbomForAi,
    Comprehensive,
}

Compliance level/profile

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Minimum

Minimum viable SBOM (basic identification)

Standard

Standard compliance (recommended fields)

NtiaMinimum

NTIA Minimum Elements compliance

CraPhase1

EU CRA Phase 1 — Reporting obligations (deadline: 11 Dec 2027)

CraPhase2

EU CRA Phase 2 — Full compliance (deadline: 11 Dec 2029)

FdaMedicalDevice

FDA Medical Device SBOM requirements

NistSsdf

NIST SP 800-218 Secure Software Development Framework

Eo14028

Executive Order 14028 Section 4 — Enhancing Software Supply Chain Security

Cnsa2

NSA CNSA 2.0 — Commercial National Security Algorithm Suite 2.0

NistPqc

NIST PQC Readiness — Post-Quantum Cryptography migration (IR 8547 + FIPS 203/204/205)

BsiTr03183_2

BSI TR-03183-2 (German national CRA-aligned SBOM technical guideline). Free, ENISA-cited; stricter than NTIA on hashes and identifiers.

CraOssSteward

CRA Article 24 — Open-source software steward profile (lighter obligations than CraPhase1/2). SBOM, vulnerability handling process, and CVD policy are still required; manufacturer email, EU DoC, and conformity-assessment-module gating are NOT.

EuccSubstantial

EUCC Substantial assurance level (Reg. (EU) 2024/482) — reference-only profile for Annex IV products. Verifies that the SBOM/sidecar carries a Common-Criteria Protection-Profile reference, Target-of-Evaluation reference, ITSEF identifier, and a valid-until date. Does not perform a Common-Criteria evaluation itself.

EuAiAct

EU AI Act (Regulation (EU) 2024/1689) Annex IV technical-documentation READINESS. Maps the Annex IV documentation obligations for high-risk AI systems onto the AI-BOM metadata sbom-tools already parses (model card, training-data characteristics, validation/testing metrics, limitations, energy disclosure). This is a documentation-readiness assessment, not a legal-conformity guarantee, and does not classify a system as high-risk. Returns N/A for SBOMs with no ML-model or dataset metadata.

BsiSbomForAi

BSI/G7 “SBOM for AI — Minimum Elements” (Feb 2026) READINESS. Scores an AI-BOM element-by-element against the seven clusters (Metadata, System-Level, Models, Datasets, Infrastructure, Security, plus the document-author elements) of the BSI/G7 minimum-elements guidance, using the AI-BOM metadata sbom-tools already parses (model card, training-data characteristics, weight hashes with NIST-approved algorithms, dataset provenance). This is a minimum-elements readiness assessment, not a legal-conformity guarantee. Returns N/A for SBOMs with no ML-model or dataset metadata.

Comprehensive

Comprehensive compliance (all recommended fields)

Implementations

impl ComplianceLevel

pub const fn name(&self) -> &'static str

Get human-readable name

pub const fn short_name(&self) -> &'static str

Get compact tab label (max ~8 chars) for terminal display.

pub const fn description(&self) -> &'static str

Get description of what this level checks

pub const fn all() -> &'static [Self]

Get all compliance levels

pub const fn is_cra(&self) -> bool

Whether this level is a CRA check. Includes the lighter Article 24 open-source steward profile, since stewards still operate under the regulation (just with reduced obligations).

pub const fn cra_phase(&self) -> Option<CraPhase>

Get CRA phase, if applicable

Trait Implementations

impl Clone for ComplianceLevel

fn clone(&self) -> ComplianceLevel

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ComplianceLevel

impl Debug for ComplianceLevel

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ComplianceLevel

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for ComplianceLevel

impl PartialEq for ComplianceLevel

fn eq(&self, other: &ComplianceLevel) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for ComplianceLevel

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ComplianceLevel