AI BOM
SBOM-equivalent for AI: models, datasets, dependencies, licenses.
The problem
Customers, auditors and regulators increasingly ask "what model, what training data, what licenses?" — an AI Bill of Materials. Answer it in a Google Doc and it breaks at ten models and fifty datasets, and a single non-commercial or copyleft license can quietly poison a paid product.
What it does
Paste a package.json, requirements.txt, or a { models, datasets } manifest and get a CycloneDX ML-BOM back — an AI SBOM of normalized components with a license-risk verdict per item and commercial-use conflict detection. Download it as JSON, or use the full AIBOM tool suite below to convert, validate, diff and template your bill of materials.
Capabilities
- CycloneDX ML-BOM component inventory (JSON export) — a standards-based AIBOM / AI SBOM
- Parses package.json, requirements.txt, or an AI { models, datasets } manifest
- Per-component license risk: ok / review / conflict / unknown
- Flags non-commercial, copyleft, and community-license traps
- Runs in the browser or as an npm package / CI gate
How you run it
Part of PlayCISO Pro: paste a manifest in the browser and download the CycloneDX JSON, or install @playciso/aibom and fail CI on any license conflict. Pair it with the free AIBOM tool suite below to convert a plain list, validate, diff, or generate a model card.
Roadmap
- Manifest parsing (npm / pip / AI manifest)
- License-conflict detection
- In-browser build + JSON export
- npm package + CI gate
- Live registry walkers (MLflow / HF)
Related tools
The free AIBOM tool suite
FAQ
What is an AIBOM (AI Bill of Materials)?
An AIBOM is an SBOM for an AI system: a machine-readable inventory of the models, datasets and code dependencies in a product, each with its version, license and provenance. It answers "what model, trained on what data, under what license?" the way an SBOM answers "what code?". This generator produces one in CycloneDX format.
What is the difference between an AIBOM and an SBOM?
An SBOM inventories code. An AIBOM extends it with the AI-specific components an SBOM ignores — models and datasets, with their licenses and provenance. In an AI product the model and its training data are dependencies with real risk, so they need to be inventoried too.
Is this AIBOM generator free?
It's part of PlayCISO Pro (from $9/week) — paste a manifest in your browser and download the CycloneDX JSON, or run it as an npm package to fail CI on any license conflict. The bundled AIBOM tool suite below (converter, validator, diff, license checker) is free.
What format does it output?
CycloneDX — the OWASP-backed SBOM standard, using its machine-learning (ML-BOM) component types for models and datasets. That means your AIBOM drops straight into the SBOM tooling, registries and vulnerability workflows you already use.
How do I build an AIBOM?
Start from what you know: list your models and datasets (the free ML-BOM Converter turns a plain list into CycloneDX), or paste a package.json / requirements.txt here to inventory dependencies. Then validate the result with the AIBOM Validator and screen each license with the Model License Checker.
AI BOM runs inside PlayCISO for subscribers. The source stays private — no public repos, nothing to fork, nothing for attackers to study. Weekly, monthly, and yearly plans all include every tool.