AI Bill of Materials (AIBOM)

An AI Bill of Materials (AIBOM) is a machine-readable inventory of every component that makes up an AI system: the models and their weights, the training and fine-tuning data, embedding models, libraries, tools, MCP servers, and external interfaces it depends on. It extends the familiar software bill of materials (SBOM) to the realities of AI — alongside code dependencies, an AIBOM records the origin, version, license, and data lineage of each model. The point is to be able to answer, at any moment, what a system is actually built from, so that a newly disclosed vulnerability, a compromised package, or a questionable model provenance can be traced and addressed rather than guessed at. Agent systems raise the stakes: because agents pull in dependencies and models on their own, they continuously add components that no human explicitly approved. Where supply chain risk names the exposure and a supply chain attack names the act, the AIBOM is the inventory itself — the foundation for audits, for compliance evidence under regimes such as the EU AI Act, and for a credible response when something goes wrong. Standards such as CycloneDX and SPDX now define dedicated formats for AI bills of materials.