AI BOM (AI Bill of Materials)
A structured inventory of every model, dataset, third-party API and dependency that makes up an AI system.
An AI Bill of Materials extends the SBOM (software bill of materials) concept to AI systems: the artefact lists every model (with version, provider, licence), every training or fine-tuning dataset (source, consent basis, retention), every third-party AI API the product calls, and the dependency graph between them. Enterprise AI procurement teams in 2026 ask for AI BOMs the way security teams asked for SBOMs after log4shell. It is not yet a formal published standard — practitioners build on CycloneDX or SPDX plus custom AI fields — but it maps directly to ISO 42001 Annex A controls on data governance and supplier relationships, and to the EU AI Act Article 53 technical documentation requirements for general-purpose AI providers.
Examples
- →A customer-support product's AI BOM lists: Claude 4 Sonnet (Anthropic, usage policy pinned), text-embedding-3-large (OpenAI, DPA on file), the internal RAG corpus (5 sources, data-sheet attached), and the re-ranking fine-tune.
- →A procurement questionnaire asks for "an AI BOM and change notification for any model swap"; the vendor ships the CycloneDX export plus a Slack webhook.
Common mistakes
- ✗Confusing AI BOM with SBOM. SBOM covers code dependencies; AI BOM covers models and data — separate inventories, often in the same file.
- ✗Publishing a frozen AI BOM. The whole value is freshness — regenerate on model swap, dataset change, or new API provider.
Authoritative sources
Related terms
- ISO 42001 Annex A — The 38 AI-specific controls that make ISO 42001 auditable — the AI analogue of ISO 27001 Annex A.
- Model card — A short structured document describing an AI model's intended use, performance, limitations and data provenance.
- AIMS (AI Management System) — The policy, process and control stack that ISO 42001 certifies — the AI-governance analogue of an ISMS.