What is an AI-BOM and which model and data assets should it record?

AI-BOM, or Artificial Intelligence Bill of Materials, uses structured records to describe an AI system's composition, sources, and relationships. It helps enterprises answer questions such as 'Which models does a particular application use, what data and software dependencies are involved, and how do changes affect deployments.' However, the list itself does not prove model safety, legal compliance of data, or absence of bias in the system.

How does an AI-BOM relate to a traditional SBOM?

SBOM records software components and their relationships. It can include self-developed, open-source, and commercial software. AI applications also need to express model artifacts, datasets, and training or deployment relationships. Therefore, the list can be expanded with additional records based on the software inventory.

SPDX 3.0.1 provides configuration files for different AI-related domains such as models, datasets, and builds. The AI Profile describes AI systems and model artifacts, while the Build Profile can describe inputs, outputs, and tools used in a build process. SPDX Configuration Files and Build Profile

What should companies record first?

Here is a minimal checklist for business implementation, not an exhaustive enumeration of standard-required fields.

• Deployment and Deployment: Application name, release version, deployment location, responsible party, and the time and scope of the checklist generation.
• Model: Release by, repository, exact version or commit number, file summary, base model relationship, license, and usage restrictions.
• Data: Description of the source of obtainable data, dataset version, purpose, authorization basis, and processing records; unclear details about training data should be clearly stated as 'unknown'.
• Software and Tools: Inference framework, runtime libraries, image, and external tool versions, along with supplementary access permissions and invocation relationships.
• Validation Evidence: Version of the report associated with security testing and applicability assessments, test conditions and scope of conclusions.

When outputting business fields to SPDX, they should be mapped and validated according to the selected version and profile. Custom tables cannot simply be labeled as 'compliant with standard'. SPDX AI Profile

How to keep the inventory current

Establish a baseline for an online application by binding the checklist to release artifacts. Compare changes each time models are updated, dependencies are modified, knowledge bases are imported, or tools are added. Clearly identify which changes require re-evaluation. The checklist should not only be exportable but also usable in vulnerability response, version management, and review processes.

Automated tools can identify some parts and dependencies, but data authorization, business purposes, and details of external services typically require additional input from the responsible party. Leaving gaps for content that cannot be identified is more valuable than producing a seemingly complete record.

Frequently asked questions

Can a model hash log prove it was not poisoned? No. Hashes are used to confirm that the file is consistent with expectations, but they cannot determine whether the expected file itself behaves safely.

Is AI-BOM feasible without complete training data? Yes, one can record known sources, publisher explanations, and unknown items while indicating evidence sources and their credibility. However, unknown items cannot be marked as approved for review.

Can a checklist replace compliance reviews? No. While checklists organize facts and evidence, specific licenses, data usage, and industry requirements still need to be evaluated in the context of actual scenarios.