Well, you can start by taking a look at regulations that start mentioning SBOMs, at first recommending their existence and use and then moving to mandating them

Well, you can start by taking a look at regulations that start mentioning SBOMs, at first recommending their existence and use and then moving to mandating them. Without looking things up, I can mention White House Executive Order 14028 (2021) and National Cybersecurity Strategy Implementation Plan (2023) in the US, EU's Cyber Resilience Act (2023), national legislation in Germany and Japan (2023-2024), etc.