AI Bill of Materials (AIBOM)

Full definition

AIBOM is being standardized through CISA, OWASP, and CycloneDX 1.5+ schemas, which added ML-specific fields. The EU AI Act and the May 2026 joint guidance from CISA and G7 partners, "Software Bill of Materials for AI – Minimum Elements", both push toward AI supply-chain transparency. A complete AIBOM tracks model name, version, weights hash, training-data sources, license, evaluation metrics, and known limitations — making "what is in production?" answerable in seconds, not weeks.

Why it matters

When a base-model license changes, a training dataset is found to contain copyrighted material, or a CVE drops on a vector DB, an AIBOM turns "search every repo" into "query the inventory." This is now table stakes for regulated enterprises and a likely procurement requirement within 24 months.

Example

A bank ingests AIBOMs from 14 vendors; when a popular embedding model is found to have leaked PII, the AIBOM index identifies the 6 affected products in 90 seconds.

Next steps

• Get a free workflow map →We map one of your workflows and give you a written verdict: software, a process change or AI. No obligation.
• AI consulting cost guide →Hourly rates and project budgets by firm tier, from independents to the Big Four.

Related terms

• AI Governance
  AI governance is the framework of policies, roles, controls, and processes an organization uses to ensure its AI systems are lawful, safe, fair, accountable, and aligned with business intent — across the full lifecycle from problem framing to retirement.
• EU AI Act
  The EU AI Act (Regulation (EU) 2024/1689) is the European Union's comprehensive, risk-tiered regulation of AI systems, the world's first horizontal AI law, with obligations phasing in from February 2025: general-purpose AI model rules from 2 August 2025 (Commission fines from 2 August 2026; models already on the market have until 2 August 2027) and, after the Digital Omnibus (Regulation (EU) 2026/1744), high-risk rules from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
• Model Card
  A model card is a short, structured document that describes an AI model's intended use, performance, limitations, training data, evaluation results across demographic and operational subgroups, and known failure modes — the AI equivalent of a nutrition label.
• AI Audit
  An AI audit is a structured, evidence-based examination of an AI system or AI program against defined criteria — covering training data, model, deployment context, monitoring, and governance — performed by an internal team, an external firm, or a regulator.

More governance & risk terms

• Datasheet for Datasets
  A datasheet for datasets is a structured document — proposed by Gebru et al. (2018) — describing a dataset's motivation, composition, collection process, labeling, preprocessing, recommended uses, distribution, and maintenance, so downstream model developers can make informed choices.
• AI Risk Assessment
  An AI risk assessment is a structured review of an AI system's potential harms — to individuals, groups, the organization, and society — covering likelihood, severity, affected populations, and mitigation controls across safety, fairness, security, privacy, and compliance dimensions.