AIBOM
Generate an AIBOM — an AI Bill of Materials, the AI SBOM (CycloneDX ML-BOM / machine learning BOM): your models, datasets, dependencies and licences in one inventory.
The problem
Customers, auditors and regulators increasingly ask "what model, what training data, what licenses?" — an AI Bill of Materials (an AIBOM, or AI BOM). Answer it in a Google Doc and it breaks at ten models and fifty datasets, and a single non-commercial or copyleft license can quietly poison a paid product.
What it does
Paste a package.json, requirements.txt, or a { models, datasets } manifest and get a CycloneDX ML-BOM back — an AI SBOM of normalized components with a license-risk verdict per item and commercial-use conflict detection. Download it as JSON, or use the full AIBOM tool suite below to convert, validate, diff and template your bill of materials.
Capabilities
- CycloneDX ML-BOM component inventory (JSON export) — a standards-based AIBOM / AI SBOM
- Parses package.json, requirements.txt, or an AI { models, datasets } manifest
- Per-component license risk: ok / review / conflict / unknown
- Flags non-commercial, copyleft, and community-license traps
- Runs in the browser or as an npm package / CI gate
How you run it
Part of PlayCISO Pro: paste a manifest in the browser and download the CycloneDX JSON, or install @playciso/aibom and fail CI on any license conflict. Pro also includes the rest of the AIBOM tool suite below, to convert a plain list, validate, diff, or generate a model card.
Roadmap
- Manifest parsing (npm / pip / AI manifest)
- License-conflict detection
- In-browser build + JSON export
- npm package + CI gate
- Live registry walkers (MLflow / HF)
Related tools
The AIBOM tool suite
FAQ
What is an AIBOM (AI Bill of Materials)?
An AIBOM is an SBOM for an AI system: a machine-readable inventory of the models, datasets and code dependencies in a product, each with its version, license and provenance. It answers "what model, trained on what data, under what license?" the way an SBOM answers "what code?". This generator produces one in CycloneDX format.
What is the difference between an AIBOM and an SBOM?
An SBOM inventories code. An AIBOM extends it with the AI-specific components an SBOM ignores — models and datasets, with their licenses and provenance. In an AI product the model and its training data are dependencies with real risk, so they need to be inventoried too.
Is this AIBOM generator free?
No. The generator is part of PlayCISO Pro (from $5/month): paste a manifest in your browser and download the CycloneDX JSON, or run it as an npm package to fail CI on any license conflict. The AIBOM tool suite below (converter, validator, diff, license checker) is also part of Pro; the AIBOM guides linked below are free to read.
What format does it output?
CycloneDX — the OWASP-backed SBOM standard, using its machine-learning (ML-BOM) component types for models and datasets. That means your AIBOM drops straight into the SBOM tooling, registries and vulnerability workflows you already use.
How do I build an AIBOM?
Start from what you know: list your models and datasets (the ML-BOM Converter, part of Pro, turns a plain list into CycloneDX), or paste a package.json / requirements.txt here to inventory dependencies. Then validate the result with the AIBOM Validator and screen each license with the Model License Checker.
Is an AIBOM the same as an AI SBOM?
Yes — "AIBOM," "AI BOM" and "AI SBOM" all name the same idea: a bill of materials for an AI system, extending the software SBOM to cover the models and datasets a plain SBOM ignores. This generator outputs one in CycloneDX (the OWASP SBOM standard, using its ML-BOM component types for models and datasets), so your AI SBOM drops straight into the same tooling and vulnerability workflows as your software SBOM.
What is an ML-BOM (machine learning BOM), and how does it relate to an AIBOM?
An ML-BOM (machine learning bill of materials) is the slice of an AIBOM that inventories machine-learning components specifically — the models and training/evaluation datasets, with their versions, licences, provenance and model cards. CycloneDX added ML-BOM component types precisely so models and datasets can sit alongside code as first-class components. In practice "ML-BOM" and "AIBOM" are used interchangeably when the system is model-centric; this generator emits CycloneDX ML-BOM components, so there is no separate machine-learning BOM software to run — it is the same tool.
AIBOM runs inside PlayCISO for subscribers. The source stays private — no public repos, nothing to fork, nothing for attackers to study. Monthly and yearly plans all include every tool.