AI Bill of Materials: [AI system or product name] [version]

An AI Bill of Materials (AI-BOM) is a machine-readable and human-readable inventory of everything an AI system is built from: models, datasets, software dependencies, agents, tools, prompts, training and evaluation configuration, lineage and known risks. This template describes the inventory and maps each field to CycloneDX 1.7 (standardised by Ecma International as ECMA-424, 2nd edition, December 2025) machine learning BOM (ML-BOM) objects and to the AI and Dataset profiles of SPDX 3.0.1. Replace every [bracketed] value and every row marked Example. Worked examples use a customer support assistant built on a fine-tuned language model with retrieval and tool access.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. System overview
3. Model inventory
4. Dataset inventory
5. Software dependencies
6. Agents, tools and prompts
7. Training and evaluation configuration
8. Model lineage
9. Vulnerability and risk annotations
10. Distribution format mapping
11. Example machine-readable excerpt
12. Generation and update process
13. Consumers and sharing policy
14. Glossary and references

1. Purpose and scope

1.1 Purpose

[State the purpose. Example: "This AI-BOM records every model, dataset, software component, tool and prompt that the Support Assistant 2.3 depends on, so that security, licensing and compliance teams can answer three questions quickly: what is inside, where did it come from, and is any part of it affected by a known vulnerability or restriction."]

1.2 Drivers

1.3 Scope

1.4 Depth and completeness

State how deep the inventory goes and what "complete" means for this release. Software dependencies follow the depth of the software SBOM (normally all transitive dependencies). For models, list every model that executes in the request path plus every model whose output was used to build an artefact that executes (for example a teacher model used for distillation, or a model used to label training data). For datasets, list every dataset that influenced weights, thresholds or a retrieval index.

2. System overview

[Describe the system in two or three sentences. Example: "Support Assistant answers customer questions in the help centre. A router model classifies intent, a fine-tuned chat model generates answers grounded in a retrieval index of help articles, and an agent runtime can call three tools: order lookup, refund request and ticket creation."]

3. Model inventory

3.1 Models

3.2 Model attributes

Record the attributes that a consumer needs to judge fitness and risk. Keep detailed performance figures in the model card; record here only what identifies and characterises the model.

3.3 Integrity and signing

[Describe how model artefacts are verified before load. Example: "Every model file is pulled from the internal registry by digest; the registry rejects artefacts without a valid signature from the release pipeline; the inference service verifies the SHA-256 digest at start-up and refuses to serve on mismatch. Formats that can execute code on load are not accepted."]

4. Dataset inventory

4.1 Datasets

4.2 Processing and quality

4.3 Third-party and undisclosed training data

[Record what is known about the training data of third-party models. Example: "The supplier of MDL-004 publishes a summary of training content but not a dataset list. The summary is archived as evidence E-07. No claim is made in this BOM about the composition of that data beyond what the supplier states."]

5. Software dependencies

The full software inventory is the software SBOM [SBOM serial number], produced by the release build as described in the supply chain security assessment (security/supply-chain-security). This section highlights the components that matter most for AI behaviour and AI-specific attacks.

6. Agents, tools and prompts

6.1 Agents

6.2 Tools and servers

6.3 Prompts and policies

7. Training and evaluation configuration

Evaluation results that support release decisions are kept in the evaluation plan and model validation report. The BOM records only which evaluation datasets and harness versions were used, so that a consumer can tell whether two releases were evaluated on the same basis.

8. Model lineage

9. Vulnerability and risk annotations

9.1 Vulnerabilities and advisories

9.2 AI risk annotations

10. Distribution format mapping

10.1 Format choice

SPDX 3.1 was published as a release candidate in January 2026; do not adopt it for distribution until a final release is announced at spdx.dev, and record the decision in the revision history when you do.

10.2 Field mapping

10.3 Properties used for gaps

When neither format has a dedicated field, use name-value properties with a registered namespace so consumers can parse them.

11. Example machine-readable excerpt

The excerpt shows one model, one dataset and the dependency between them in CycloneDX 1.7 JSON. Values are examples.

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
  "version": 1,
  "metadata": {
    "timestamp": "2026-10-01T09:00:00Z",
    "component": {
      "type": "application",
      "bom-ref": "app-support",
      "name": "support-assistant",
      "version": "2.3.0"
    }
  },
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "MDL-002",
      "name": "intent-router",
      "version": "1.4.0",
      "hashes": [{ "alg": "SHA-256", "content": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08" }],
      "licenses": [{ "license": { "name": "Proprietary" } }],
      "modelCard": {
        "modelParameters": {
          "approach": { "type": "supervised" },
          "task": "text-classification",
          "architectureFamily": "transformer",
          "modelArchitecture": "encoder-only",
          "datasets": [{ "ref": "DS-003" }],
          "inputs": [{ "format": "string" }],
          "outputs": [{ "format": "string" }]
        },
        "quantitativeAnalysis": {
          "performanceMetrics": [{ "type": "macro-F1", "value": "0.91", "slice": "all-languages" }]
        },
        "considerations": {
          "technicalLimitations": ["Lower accuracy for messages shorter than three words"]
        }
      }
    },
    {
      "type": "data",
      "bom-ref": "DS-003",
      "name": "intent-labels",
      "version": "1.4",
      "data": [
        {
          "type": "dataset",
          "name": "intent-labels",
          "classification": "confidential",
          "description": "Ticket subjects labelled by an external vendor; pseudonymised",
          "governance": { "owners": [{ "organization": { "name": "[Organisation]" } }] }
        }
      ]
    }
  ],
  "dependencies": [
    { "ref": "app-support", "dependsOn": ["MDL-002"] },
    { "ref": "MDL-002", "dependsOn": ["DS-003"] },
    { "ref": "DS-003", "dependsOn": [] }
  ]
}

12. Generation and update process

12.1 Generation

12.2 Update triggers

Regenerate the AI-BOM and increase its version on any of the following events, and record the change in the revision history:

• a model, dataset, prompt, tool or agent configuration changes version;
• a dependency is added, removed or upgraded in the software SBOM;
• a vulnerability or risk annotation changes status;
• a supplier publishes new information about a third-party model or dataset (for example a revised training content summary or licence);
• a dataset is withdrawn or a data subject request changes its content.

12.3 Quality checks

13. Consumers and sharing policy

Retention: keep each published AI-BOM for as long as the release it describes is supported, plus [n] years, and at least as long as any technical documentation that references it.

14. Glossary and references

References:

• CycloneDX 1.7 specification and JSON schema, https://cyclonedx.org/specification/overview/
• ECMA-424, 2nd edition (December 2025), https://ecma-international.org/publications-and-standards/standards/ecma-424/
• SPDX 3.0.1 specification, AI profile and Dataset profile, https://spdx.github.io/spdx-spec/v3.0.1/
• SPDX project news on 3.1 release candidates, https://spdx.dev/
• Related templates: ai-data/model-card, ai-data/datasheet-for-datasets, security/supply-chain-security, ai-data/ai-act-technical-documentation, security/cra-vulnerability-handling, ai-data/guardrails-spec

Standard and licence note

Based on the CycloneDX 1.7 specification (OWASP CycloneDX, standardised as ECMA-424, 2nd edition, December 2025) and the SPDX 3.0.1 specification (Linux Foundation SPDX project), including its AI and Dataset profiles. Field and property names are cited for interoperability; all explanatory text is original and no specification text is reproduced. Both specifications evolve: check the current versions at cyclonedx.org and spdx.dev before changing a BOM generator. Template licence: MIT.