AI Bill of Materials (AIBOM)
An AI Bill of Materials (AIBOM) is a structured, machine-readable inventory of every component used in an AI system — base models, fine-tuning datasets, third-party APIs, prompts, vector indexes, libraries, and licenses — extending the SBOM concept to AI supply chains.
Full definition
AIBOM is being standardized through CISA, OWASP, and CycloneDX 1.5+ schemas, which added ML-specific fields. The EU AI Act and US AI Executive Order both push toward AI supply-chain transparency. A complete AIBOM tracks model name, version, weights hash, training-data sources, license, evaluation metrics, and known limitations — making "what is in production?" answerable in seconds, not weeks.
Why it matters
When a base-model license changes, a training dataset is found to contain copyrighted material, or a CVE drops on a vector DB, an AIBOM turns "search every repo" into "query the inventory." This is now table stakes for regulated enterprises and a likely procurement requirement within 24 months.
Example
A bank ingests AIBOMs from 14 vendors; when a popular embedding model is found to have leaked PII, the AIBOM index identifies the 6 affected products in 90 seconds.
Related terms
- AI GovernanceAI governance is the framework of policies, roles, controls, and processes an organization uses to ensure its AI systems are lawful, safe, fair, accountable, and aligned with business intent — across the full lifecycle from problem framing to retirement.
- EU AI ActThe EU AI Act (Regulation (EU) 2024/1689) is the European Union's comprehensive, risk-tiered regulation of AI systems, the world's first horizontal AI law, with obligations phasing in from February 2025 and full general-purpose AI rules applying from August 2025.
- Model CardA model card is a short, structured document that describes an AI model's intended use, performance, limitations, training data, evaluation results across demographic and operational subgroups, and known failure modes — the AI equivalent of a nutrition label.
- AI AuditAn AI audit is a structured, evidence-based examination of an AI system or AI program against defined criteria — covering training data, model, deployment context, monitoring, and governance — performed by an internal team, an external firm, or a regulator.
Source & further reading
Primary source: CycloneDX — Machine Learning BOM (CycloneDX 1.5+) (2024).
Citation policy: this entry is part of the AIDOLS AI Implementation Glossary and may be quoted for research, journalism, and education with attribution to aidolsgroup.com/es/glossary/ai-bom/.