diff --git a/schema/2.0/model/cyclonedx-threat-2.0.schema.json b/schema/2.0/model/cyclonedx-threat-2.0.schema.json
index edc8748c..96a73be7 100644
--- a/schema/2.0/model/cyclonedx-threat-2.0.schema.json
+++ b/schema/2.0/model/cyclonedx-threat-2.0.schema.json
@@ -230,12 +230,13 @@
                 "type": "string",
                 "title": "Taxonomy",
                 "description": "The threat classification taxonomy that the category is drawn from.",
-                "enum": ["STRIDE", "LINDDUN", "MAESTRO", "MITRE-ATTACK"],
+                "enum": ["STRIDE", "LINDDUN", "MAESTRO", "MITRE-ATTACK", "ATLAS"],
                 "meta:enum": {
                   "STRIDE": "Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.",
                   "LINDDUN": "Linkability, Identifiability, Non-repudiation, Detectability, Disclosure of information, Unawareness, and Non-compliance.",
                   "MAESTRO": "Multi-Agent Environment, Security, Threat, Risk, and Outcome, whose categories are its seven architectural layers.",
-                  "MITRE-ATTACK": "The MITRE ATT&CK framework, whose categories are its Enterprise tactics."
+                  "MITRE-ATTACK": "The MITRE ATT&CK framework, whose categories are its Enterprise tactics.",
+                  "ATLAS": "The MITRE ATLAS framework for AI system threats, whose categories are its tactics."
                 }
               },
               "category": {
@@ -323,6 +324,37 @@
                     }
                   }
                 }
+              },
+              {
+                "if": {
+                  "required": ["taxonomy"],
+                  "properties": { "taxonomy": { "const": "ATLAS" } }
+                },
+                "then": {
+                  "properties": {
+                    "category": {
+                      "enum": ["reconnaissance", "resource-development", "initial-access", "ai-model-access", "execution", "persistence", "privilege-escalation", "defense-evasion", "credential-access", "discovery", "lateral-movement", "collection", "ai-attack-staging", "command-and-control", "exfiltration", "impact"],
+                      "meta:enum": {
+                        "reconnaissance": "Gathering information about the target AI system to plan future operations.",
+                        "resource-development": "Establishing resources to support operations against AI systems.",
+                        "initial-access": "Gaining an initial foothold in an AI system or its operating environment.",
+                        "ai-model-access": "Gaining access to an AI model or the context needed to interact with it.",
+                        "execution": "Running adversary-controlled code through AI artifacts or supporting software.",
+                        "persistence": "Maintaining a foothold using AI artifacts, software, or related infrastructure.",
+                        "privilege-escalation": "Gaining higher-level permissions in an AI system or environment.",
+                        "defense-evasion": "Avoiding detection by AI-enabled security software or related controls.",
+                        "credential-access": "Obtaining account names, passwords, tokens, or similar credentials.",
+                        "discovery": "Learning about the AI environment and surrounding systems.",
+                        "lateral-movement": "Moving through an AI environment to reach other systems or components.",
+                        "collection": "Gathering AI artifacts or related information relevant to the adversary's objective.",
+                        "ai-attack-staging": "Tailoring or preparing an attack using knowledge of the target AI system.",
+                        "command-and-control": "Communicating with compromised AI systems or infrastructure to control them.",
+                        "exfiltration": "Stealing AI artifacts or other information about the AI system.",
+                        "impact": "Manipulating, interrupting, eroding confidence in, or destroying AI systems or data."
+                      }
+                    }
+                  }
+                }
               }
             ]
           }
diff --git a/tools/src/test/resources/2.0/invalid-threatmodel-atlas-category-taxonomy-mismatch-2.0.json b/tools/src/test/resources/2.0/invalid-threatmodel-atlas-category-taxonomy-mismatch-2.0.json
new file mode 100644
index 00000000..d58cc0af
--- /dev/null
+++ b/tools/src/test/resources/2.0/invalid-threatmodel-atlas-category-taxonomy-mismatch-2.0.json
@@ -0,0 +1,18 @@
+{
+  "specFormat": "CycloneDX",
+  "specVersion": "2.0",
+  "threats": {
+    "threats": [
+      {
+        "bom-ref": "threat-bad-atlas-category",
+        "name": "ATLAS taxonomy paired with a LINDDUN category value",
+        "categories": [
+          {
+            "taxonomy": "ATLAS",
+            "category": "linkability"
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/tools/src/test/resources/2.0/valid-threatmodel-simple-2.0.json b/tools/src/test/resources/2.0/valid-threatmodel-simple-2.0.json
index d8d14f03..6d1b0968 100644
--- a/tools/src/test/resources/2.0/valid-threatmodel-simple-2.0.json
+++ b/tools/src/test/resources/2.0/valid-threatmodel-simple-2.0.json
@@ -33,6 +33,10 @@
           {
             "taxonomy": "MITRE-ATTACK",
             "category": "credential-access"
+          },
+          {
+            "taxonomy": "ATLAS",
+            "category": "credential-access"
           }
         ],
         "weaknesses": [