What NIST should know when updating the SSDF for AI

This SonarSource blog argues that NIST's SSDF must be updated for AI-generated code, highlighting three structural problems—AI non-determinism, unscalable human review for agentic code volumes, and AI as an active attack surface—and recommends mandatory layered, deterministic verification, scaled supply-chain controls, and alignment with regulations like the EU Cyber Resilience Act.