AI Bill of Materials (AIBOM).

A machine-readable inventory of every component that goes into an AI system — datasets, base models, fine-tuning data, libraries, prompts, and evaluation artifacts — used for security, compliance, and accountability. It belongs to the AI & ML Security category of cybersecurity.

A machine-readable inventory of every component that goes into an AI system — datasets, base models, fine-tuning data, libraries, prompts, and evaluation artifacts — used for security, compliance, and accountability.

An AIBOM extends the SBOM concept from software to AI systems. Initiatives such as CISA's AIBOM working group, SPDX 3 AI Profile, CycloneDX ML-BOM, and the EU AI Act's technical-documentation requirements prescribe metadata: dataset provenance and licenses, base-model identifiers and versions, fine-tuning recipes, hyper-parameters, evaluation results, and known limitations. AIBOMs help organisations trace the impact of a poisoned dataset or backdoored base model, demonstrate regulatory compliance, manage AI supply-chain risk, support model recall, and feed vulnerability databases (OSV-AI, MITRE ATLAS). Mature MLSecOps programs generate AIBOMs automatically from training pipelines and store them alongside signed model artefacts.

Defences for AI Bill of Materials (AIBOM) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: AIBOM, ML-BOM.