Supply Chain Security for Models · AI BOM & Supply Chain Monitoring
Publish an AI bill of materials
Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin statements.
OWASP AISVS v1.01, requirement 6.2.1
In plain English
Publish a machine-readable bill of materials for every model: its datasets, weights, licences and where the data came from. An AI BOM does for a model what a software bill of materials does for an application. When a dataset or base model turns out to be a problem, it tells you which of your models are affected.
What good looks like
- Every model version has an AI BOM in a standard format.
- It lists the base model, training and fine-tuning datasets, licences and data-origin statements.
- It is kept under version control and tied to the artifact by hash.
- It is regenerated whenever a component changes.
How teams usually do it
- CycloneDX (which has had a machine-learning BOM type since version 1.5) or the SPDX 3.0 AI and Dataset profiles.
- Generating the BOM in the training or packaging pipeline from the run's real inputs.
- Including software dependencies of the serving stack, or linking to the ordinary SBOM that covers them.
Suggested evidence
- AI BOM files for the deployed models.
- The pipeline step that produces them.
- A BOM matched against the inputs of the training run it describes.
Common mistakes
- Writing the BOM by hand once, so it drifts from reality.
- Listing the base model and leaving out the fine-tuning data.
- A PDF or wiki page that no tool can read.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.