AI bill of materials (AI BOM)
An AI BOM is the inventory of models, datasets, weights and dependencies behind an AI system — what lets you answer whether you are affected after a disclosure.
An AI bill of materials is the machine-readable inventory of everything an AI system is built from: base models and their versions, fine-tuned weights and what they were trained on, datasets and their provenance and licences, the embedding model and vector store behind retrieval, the serving framework, and the ordinary software dependencies underneath all of it.
It is the AI extension of the software bill of materials idea, and it exists for the same reason: after a disclosure, the only question that matters is "are we affected, and where?" — and that question is unanswerable in hours unless the inventory already exists.
Why the software BOM is not enough
An SBOM covers the code. It does not cover the artefacts that carry most of the new risk:
- Model weights are executable content. Serialised formats have been used to achieve arbitrary code execution on load, and a weight file downloaded from a public hub is an untrusted binary from an unverified publisher.
- Datasets carry licence obligations and poisoning risk, and they are the thing you need to trace when a corpus is later found to be compromised.
- Model versions move underneath you. A hosted endpoint pinned to an alias rather than a version can change behaviour — and safety behaviour — without any change on your side.
What to record, minimally
- Every model in use, by provider, exact version and the endpoint it is called through.
- For each fine-tuned model: base model, dataset, date, and who approved it.
- Datasets: source, licence, collection date, and whether they contain personal data.
- Embedding model and vector store, with the index build date.
- The applications and environments each of the above is reachable from.
Where the requirement comes from
The EU AI Act (Regulation (EU) 2024/1689) obliges providers of general-purpose and high-risk systems to maintain technical documentation covering exactly this material, and the NIST AI Risk Management Framework (NIST AI 100-1) puts inventory under its Map function as a precondition for every measurement that follows.
The practical test of an AI BOM is not whether it exists. It is whether it is derived from what is actually running, or maintained by hand — because a hand-maintained inventory is accurate on the day it is written and never again.