AI Bills of Materials Gain Momentum, but Practical Adoption Lags

Summary

AI bills of materials (AI BOMs) are gaining support from regulators and security groups to document models, datasets, provenance and runtime dependencies. Adoption remains immature as AI supply-chain risks grow.

Key points

• AI BOMs extend software bills of materials (SBOMs) by documenting AI-specific components such as models, datasets, training history, licensing and runtime dependencies.
• The article reports that regulators in Europe and the US are beginning to require AI BOM-related documentation for high-risk systems, while the G7 has issued guidance on expected elements.
• ISACA and security leaders recommend AI BOMs for procurement and risk reviews, but there is not yet a universally mandated standard and practical adoption remains limited.
• Proposed documentation includes model versions, data lineage and provenance, software dependencies, configuration, deployment context and human oversight records.
• Experts say documentation for agentic AI may also need to cover retrieval sources, tool integrations, agent chains, identities and permissions.
• The article cites growth on Hugging Face to 2 million models and 500,000 datasets, and a JFrog report finding a 6.5-fold increase in malicious models identified on the platform year over year.
• Research cited in the article documented backdoored models that passed Hugging Face security checks.

People