An AI bill of materials (AIBOM) is an inventory of everything an AI system is built from: the models, training and evaluation datasets, code dependencies and services, each with name, version, source and hash. For a Python project, start from your lockfile and add every model file and dataset you load.
Why is a normal SBOM not enough?
A software bill of materials lists packages. A Python AI app also loads model weights downloaded from a hub, reads datasets, calls hosted model APIs and applies prompts and configuration. None appear in a requirements file. If a model is replaced or a dataset altered, the lockfile still looks identical.
Two open formats now cover this. CycloneDX has a machine learning BOM capability that describes models and datasets as components. SPDX 3.0 includes an AI profile with fields for AI-specific information. Either gives you a structured, exchangeable record.
What should the inventory contain?
Models. Name, version or revision, publisher, where it was fetched from, license, file format and a cryptographic hash of the weights. Note whether it is fine-tuned from another model.
Datasets. Name, source, version, license, collection method and known limits. For training data, record what was used for training, validation and testing.
Code. Python packages from your lockfile, including transitive ones, with versions and hashes.
Services. Hosted model endpoints and third-party APIs, with the provider and the model identifier the call requests.
Runtime settings. System prompts, tool lists and retrieval sources are part of behaviour. Record where they are stored and how they change.
Owners and dates. Who is responsible and when each entry was last verified.
Why does file format matter?
Some Python model formats rely on serialization that can execute code when loaded. The Python documentation for the pickle module warns that it is not secure and that you should only unpickle data you trust. When recording a model, note its file format and prefer data-only formats where your tools support them. Check the documentation of the formats you use.
A constructed example
A Python service uses a fine-tuned text classifier. The AIBOM entry for the model says: name internal-triage-v3, revision 3, base model with its publisher and revision, weights file in a data-only format with a SHA-256 hash, fine-tuned on dataset "tickets-2025q4" version 2 with its license and owner. Six months later someone swaps in a new weights file under the same name. The hash check in the deploy step fails, because the BOM says otherwise, and the swap is caught before it ships.
How does this help in an incident?
When a flaw is announced in a model, library or dataset, the first question is whether you use it and where. An AIBOM turns that into a search instead of a week of asking teams. It also supports licence checks, since model and dataset licences can restrict commercial use, and it gives auditors a dated record of what ran in production on a given day. Keep old versions of the file with each release so you can answer questions about the past.
How to check or apply this
- Export your Python dependencies with hashes from your lockfile and generate a standard SBOM from it.
- Grep for model loading code, such as hub downloads and local weight paths, and list every model it touches.
- Pin each model to an exact revision or content hash, never to a moving label like latest.
- Add datasets and their versions, and note licenses and restrictions on use.
- List hosted APIs and which model each call requests.
- Store the AIBOM in CycloneDX or SPDX, in the repository, and generate it in CI on each release.
- Verify hashes at build and at deployment, and fail on mismatch.
- Review the AIBOM when a model, dataset or provider changes, and assign an owner.
Where does scanning help?
Dependency and SBOM scanning cover the code layer of this inventory, including vulnerability matching for Python packages. Safeguard offers that, and a free in-browser scan at gold.safeguard.sh/scan for up to 100 dependencies. Models and datasets still need the manual records described above.
Quick check
Is an AIBOM required by law?
Requirements differ by jurisdiction and sector, so check the rules that apply to you. Regardless of law, an inventory is the base for any AI risk management work.
Do I need to hash model files?
Yes if you want to detect silent replacement. A hash ties the record to exact content.
Sources
- CycloneDX, machine learning BOM
- SPDX 3.0.1, AI profile
- Python documentation, pickle
- NIST AI Risk Management Framework 1.0
Last reviewed: 18 October 2026.
