All posts
Topic · 26 articles
AIBOM guides: the AI bill of materials, field by field
An AIBOM (AI bill of materials) is a machine-readable inventory of the models, datasets and dependencies in an AI system, with their versions, licences and provenance. These guides walk through the formats, each section of an AIBOM and how teams use one for audits and incidents.
Put it into practice
Guides and explainers (21)
EU AI Act Annex IV Documentation, Item by Item
The nine points of EU AI Act Annex IV in one table: what each asks, which AIBOM fields supply it, and a worked example for a fictional support assistant.
October 29, 2026
The EU GPAI Model Documentation Form Explained
Each section of the EU GPAI Model Documentation Form, who gets which item (AI Office, authorities, downstream providers) and what fine-tuners can expect.
October 29, 2026
CycloneDX ML-BOM: Fields and a Worked Example
Every CycloneDX 1.7 ML-BOM part explained: model card, datasets, RAG and MCP services, signatures. With a field table and a valid worked example file.
October 29, 2026
SPDX 3.0 AI and Dataset Profiles, With Example
SPDX 3.0.1 AIPackage and DatasetPackage fields explained with a worked JSON-LD example, a field table, and the gaps you will hit modelling an AI system.
October 29, 2026
Croissant RAI: Dataset Metadata With an Example
Croissant 1.1 and the RAI vocabulary explained with a worked dataset file, a field table and a naming mismatch in mlcroissant that silently drops fields.
October 29, 2026
Real Model Cards, Reviewed and Scored
Five public model cards (Llama 3.1, Phi-4, gpt-oss, Gemma 3, Mistral 7B) scored against one 10-point rubric, with what each states and what it leaves out.
October 29, 2026
AIBOM Identity, Provenance and Lineage
The AIBOM fields that pin a model’s identity and record its base model, fine-tunes, adapters, merges and quantisations, with CycloneDX and SPDX excerpts.
October 29, 2026
The AIBOM Data Section: Datasets and Licensing
Each dataset fact in CycloneDX, SPDX 3.0, Croissant RAI and Hugging Face cards, mapped to EU AI Act Article 10, with a fictional training set filled in.
October 29, 2026
The AIBOM Security and Runtime Section
How to record weights format, loader settings, CVEs with a VEX verdict, model signing, MCP servers and RAG indexes in an AIBOM, with a CycloneDX example.
October 29, 2026
AIBOM Evaluation, Intended Use and Risk
The AIBOM fields for metrics, intended use, out-of-scope use, limitations and risk in CycloneDX, SPDX 3.0 and model cards, with fictional numbers and gaps.
October 29, 2026
AIBOM Questions to Ask Every AI Vendor
Twenty AIBOM questions for AI vendors in six groups: why each matters, the field that proves a good answer, the red flag, and contract clauses to ask for.
October 29, 2026
AIBOM in Incident Response: Which Model Ran?
A worked AI incident on a vLLM model-loading advisory: the timeline, what to preserve, how to scope the blast radius and the VEX entry to write after.
October 29, 2026
AIBOM as Compliance Evidence: AI Act, 42001
A crosswalk from AIBOM, model card and dataset card fields to the EU AI Act, ISO/IEC 42001 Annex A and NIST AI RMF, plus what the AIBOM cannot prove.
October 29, 2026
Who Can Attest to an AI Model, and to What
Six kinds of AI model attestation, from a supplier’s own AIBOM to an EU notified body: who issues each, and a table of what each proves and does not.
October 29, 2026
Model Signing: Sign an AI Model and Attest Provenance
A worked example: sign model files with the OpenSSF model_signing CLI, see real verify failures, add SLSA provenance in CI and link both from the AIBOM.
October 29, 2026
AI Model Transparency: A Framework for Security Leaders
AI model transparency means documenting how a model was built, trained, and tested — here's a concrete framework CISOs can apply today.
October 7, 2026
AIBOM Parameters: A Field-by-Field Checklist
Exactly what to capture in an AI Bill of Materials (AIBOM) — models, datasets, AI/ML dependencies, configuration, and risk metadata — mapped to CycloneDX ML-BOM and SPDX 3.0 AI Profile, with a copy-paste checklist and the PlayCISO tools to generate and validate one.
October 2, 2026
AI Supply Chain Transparency: A Practical Guide
What AI supply chain transparency means, why AI systems are opaque by default, and how an AIBOM gives you the visibility auditors and regulators expect.
September 28, 2026
How to Build an AIBOM (AI Bill of Materials)
An AIBOM inventories the models, data and software that make up an AI system. A step-by-step guide to building one, what to include, and the formats that make it useful.
September 26, 2026
ML-BOM Explained: Machine Learning BOM and Tools
An ML-BOM (machine learning bill of materials) inventories a system’s models, datasets and provenance, in CycloneDX or SPDX. Versus SBOM and AIBOM.
September 26, 2026
AIBOM (AI Bill of Materials): What It Is, Why It Matters
AIBOM: a machine-readable inventory of every model, dataset and dependency in an AI system. What it must include, versus an SBOM, and how to generate one.
August 23, 2026
Comparisons (5)
AIBOM Standards and Templates Compared
CycloneDX, SPDX 3.0, Croissant, the EU forms and five card templates in one table: who owns each, what it covers, its legal status and who should use it.
October 29, 2026
Model Card Templates Compared: HF, Google, IBM
Hugging Face, Google Model Cards and IBM AI FactSheets compared section by section, plus the CycloneDX modelCard mapping and a 10-point good-card check.
October 29, 2026
Dataset Card Templates: Datasheets to Croissant
Datasheets for Datasets, Google Data Cards, Hugging Face dataset cards and Croissant RAI compared question by question, with a filled Northwind example.
October 29, 2026
AIBOM Tools Compared (2026): Formats, Open Source, Vendors
A practical comparison of how to produce an AI Bill of Materials in 2026 — CycloneDX ML-BOM vs SPDX 3.0 AI Profile, the best open-source/GitHub generators, the commercial AI-SPM platforms that offer AIBOM, and the PlayCISO tools you can use today.
October 2, 2026
SBOM vs AIBOM vs MLBOM: What's the Difference?
SBOM vs AIBOM vs MLBOM (ML-BOM, AI SBOM): what each bill of materials inventories, the CycloneDX and SPDX 3.0 formats, and when you need each one.
September 26, 2026