AI supply-chain security
The AIBOM Library
An AI Bill of Materials (AIBOM) lists everything inside an AI system: the models, the data they learned from, the code and services around them, and where each came from. This library collects every PlayCISO guide and tool on it. The guides are free to read; the templates, scorers and labs that turn them into work you can hand in are part of Pro.
Pick your path
CISO / Security Leader
Decide which AI models and vendors are acceptable, and report AI supply-chain risk to the board.
SOC / Blue-team Analyst
Know exactly which model, version and components were running when something goes wrong.
GRC / Compliance
Turn AI documentation into evidence for the EU AI Act, ISO/IEC 42001 and NIST AI RMF.
AppSec & AI-Security Engineer
Generate, validate, sign and keep AIBOMs current in the build pipeline.
Start here
- GuideWhat is an AIBOM?The AI Bill of Materials in plain words, and why it exists.
- GuideSBOM vs AIBOM vs MLBOMThree bills of materials, what each covers and when you need which.
- GuideHow to build an AIBOMA step-by-step build, from inventory to a validated file.
- GuideAIBOM tools and vendors comparedWhich tools generate, validate and manage AIBOMs.
- ToolWhich AIBOM fields matter for your role?A two-minute quiz that sends you down your reading path.
Standards and templates
- GuideML-BOM explainedThe machine-learning BOM and the software that produces it.
- GuideAIBOM standards and templates comparedCycloneDX, SPDX 3.0, Croissant, the EU forms and the card formats side by side.
- GuideCycloneDX ML-BOM: fields and a worked exampleEvery ML-BOM component explained, with a complete example file.
- GuideSPDX 3.0 AI and Dataset profiles: fields and an exampleWhat the SPDX AI and Dataset profiles record, with an example.
- GuideCroissant and Croissant RAI: dataset metadata with an exampleMLCommons dataset metadata and its responsible-AI extension.
- GuideEU AI Act Annex IV technical documentation, item by itemWhat high-risk AI documentation must contain, mapped to AIBOM fields.
- GuideThe EU GPAI Model Documentation Form explainedWhat general-purpose AI providers must document, and for whom.
What goes in each section
- GuideAIBOM parameters checklistEvery field an AIBOM should carry, in one checklist.
- GuideAIBOM identity, provenance and lineageModel IDs, versions, base models, fine-tunes and merges.
- GuideThe AIBOM data section: datasets, licensing and sensitive dataRecording training and evaluation data so it stands up to a regulator.
- GuideThe AIBOM security and runtime sectionSerialization formats, vulnerabilities, signing, agents, tools, MCP and RAG.
- GuideAIBOM evaluation, intended use, limitations and riskThe fields that tell a buyer what the model is safe to do.
Model cards and dataset cards
- GuideModel card templates comparedHugging Face vs Google Model Cards vs IBM FactSheets, and what a good card has.
- GuideDataset card templates comparedDatasheets for Datasets vs Data Cards vs Hugging Face vs Croissant.
- GuideReal model cards, reviewed and scoredPublic model cards scored against one rubric, with what each gets right and misses.
Attestation and signing
By role
Tools, labs and templates (Pro)
- ToolSBOM vs AIBOM vs MLBOM comparisonInteractive side-by-side of the three BOM types.
- Tool · ProAIBOM Template & Model Card GeneratorFill in a template and export an AIBOM and model card.
- Tool · ProAIBOM ValidatorLint a CycloneDX ML-BOM for missing and malformed fields.
- Tool · ProCycloneDX ML-BOM ConverterConvert model metadata into a CycloneDX ML-BOM.
- Tool · ProAIBOM Diff / Drift DetectorSee what changed between two AIBOM versions.
- Tool · ProAIBOM vs SBOM AnalyzerWhat your SBOM misses about your AI components.
- ToolAI Supplier QuestionnaireQuestions to send an AI vendor before you buy.
- Tool · ProAIBOM Template LibraryCycloneDX, SPDX and Croissant example AIBOMs to download and adapt.
- Tool · ProAIBOM Format Field MapThe same field across CycloneDX, SPDX, Croissant and the EU forms.
- Tool · ProModel Card ScorerScore a model card against the rubric and get the missing sections.
- Tool · ProDataset Card Builder and ScorerBuild or score a dataset card in the Datasheets / Data Cards style.
- Tool · ProEU AI Documentation BuilderAnnex IV technical documentation and the GPAI Model Documentation Form.
- Tool · ProAI Model Intake and Approval ChecklistThe gate a model passes before it reaches production.
- Tool · ProAI Model Attestation PlannerWhich attestations you need, who can issue them, and the evidence.
- Tool · ProAIBOM Maturity Self-AssessmentScore your AI supply-chain transparency and get a board one-pager.
- Lab · ProAIBOM Incident Scoping LabUse AIBOMs to scope a compromised model or dependency.
- Lab · ProModel Signing and Provenance LabVerify signatures and lineage, and catch the tampered model.
- Lab · ProSpot the Gaps: AIBOM LabFind what each AIBOM is missing before an auditor does.