Transparency for the AI supply chain

A traditional SBOM inventories software components and their dependencies – libraries, versions, licences. The behaviour of an AI system, however, is largely determined by artefacts that this grid does not capture: the model itself, its weights, the training and evaluation datasets, and their provenance and preprocessing. A model can change fundamentally through retraining or fine-tuning without a single line of code or package version moving. An AI-SBOM therefore extends the inventory to include exactly these components – as a prerequisite for being able to assess the provenance, integrity and risks of an AI system at all.

CycloneDX has supported the ML-BOM since version 1.5 (June 2023): the component types "machine-learning-model" and "data" place models and datasets on an equal footing with software libraries. A "modelCard" object documents intended use, limitations, biases, training parameters, datasets used, performance metrics and ethical considerations; data components capture, among other things, contents, classification, sensitive data and governance. The specification was first published as the international standard ECMA-424 in June 2024; the current 2nd edition (December 2025) corresponds to CycloneDX 1.7 (October 2025).

SPDX, the second major SBOM format, has been organised into modular profiles since version 3.0 (April 2024, currently 3.0.1 from December 2024) – including a dedicated AI profile and a Dataset profile. The AI profile describes AI packages ("AIPackage") with properties such as model type, training information, energy consumption and a safety risk assessment; the Dataset profile documents datasets ("DatasetPackage") with size, type, availability, preprocessing, sensitive information contained and known biases. A version 3.1 so far exists only as a release candidate, i.e. it is still at the draft stage.

Model cards go back to the paper "Model Cards for Model Reporting" (Mitchell et al., FAT* conference 2019): a standardised short documentation per model covering intended use, evaluation results under different conditions – for example across demographic groups – and known limitations. They are common practice on model hubs today, but mostly as free text without a binding schema. CycloneDX turns the concept into a machine-readable format with the "modelCard" field, making it usable for automated checks, procurement decisions and risk assessments.

The risks are well documented: in February 2024, JFrog identified around 100 malicious models on Hugging Face whose payload executes when the model is loaded – made possible by the pickle format, which can execute arbitrary Python code during deserialisation and was long the default format for PyTorch weights; safetensors, import scanning and signed artefacts are considered countermeasures. The framework level is affected as well: via dependency confusion, the package "torchtriton" was placed on PyPI in December 2022 and exfiltrated SSH keys and system data, among other things, from PyTorch nightly installations. OWASP therefore lists the AI supply chain as a dedicated Top 10 risk (LLM03:2025 Supply Chain) and explicitly recommends an up-to-date component inventory via SBOM or AI-BOM.

The Cyber Resilience Act (Regulation (EU) 2024/2847) obliges manufacturers of products with digital elements to identify and document vulnerabilities and components – including an SBOM "in a commonly used and machine-readable format" covering at least the top-level dependencies (Annex I Part II No. 1); the reporting obligations apply from 11 September 2026, the main obligations from 11 December 2027. The AI Act (Regulation (EU) 2024/1689) requires technical documentation for high-risk AI systems under Art. 11 and Annex IV, including on datasets (provenance, scope, main characteristics) and on the use of pre-trained systems or third-party tools. Under Art. 53, providers of GPAI models have had to provide technical documentation (Annex XI), information for downstream providers (Annex XII) and a sufficiently detailed summary of the training content since 2 August 2025; the Regulation applies in essence from 2 August 2026. A well-maintained AI-SBOM provides the data foundation for both legal acts.