Implementation guide
OWASP AISVS v1.01
Supply Chain Security for Models · AI BOM & Supply Chain Monitoring
Fail builds with incomplete AI BOMs
Verify that AI BOM completeness checks fail the build if any component metadata is missing.
OWASP AISVS v1.01, requirement 6.2.3
In plain English
Make the build fail when a bill of materials is missing information. A BOM with blank licence or origin fields looks finished and tells you nothing when you need it.
What good looks like
- The required fields for each component type are written down: for example name, version, hash, supplier, licence and data origin.
- The build validates every BOM and fails if a required field is missing or empty.
- Placeholder values such as "unknown" or "NOASSERTION" count as missing.
- An exception needs a named approver and an expiry date.
How teams usually do it
- Schema validation in the build pipeline, plus a short policy script for the fields the schema leaves optional.
- Policy-as-code checks (for example with Open Policy Agent's conftest) so the rules are versioned and reviewed.
Suggested evidence
- The required field list.
- An example of a build that failed on an incomplete BOM.
- The exception register.
Common mistakes
- Checks that print a warning and carry on.
- Validating that the file parses and not that the fields are filled in.
- A permanent exception for the one dataset nobody can trace.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.