An SBOM is enough if your software has no models you ship or load. If it does, add model entries, either through an ML-BOM or by extending your SBOM. An SBOM lists software components. An ML-BOM also describes models, datasets and AI configuration, including provenance.
Definitions
An SBOM is a machine readable list of the components in a piece of software, with versions and relationships. An ML-BOM, in CycloneDX terms, represents models, datasets and their dependencies, including dataset provenance, training methodology and the configuration of AI frameworks.
CycloneDX describes the AI/ML-BOM as part of one family of bills of materials, so the two are meant to work together, not compete.
A decision table
| Your software | Use |
|---|---|
| Ordinary application, no models | SBOM |
| Calls a hosted model through an API | SBOM, plus a record of the provider and model name |
| Ships or loads model files you downloaded | SBOM plus model entries |
| Trains or fine tunes models | ML-BOM with dataset information |
| Sells to buyers who ask about AI | Whichever the buyer names, with one source of truth behind it |
The second row surprises people. A hosted model is not a file in your build, but it is a third party dependency, and a buyer review will ask about it. See do you need an AI BOM entry for a model you only call through an API.
What to put in a model entry
Keep it brief at first: name, version, source, license, hash if you have a file, where it is used, and who approved it. Add dataset notes only if you train or fine tune.
What buyers should ask a tool
- Can it produce an SBOM in a standard format?
- Can model entries be added automatically, or only by hand?
- Can both live in one document?
- Does the export keep the dates you need for audit?
If model entries are manual, that is acceptable at small scale. Write down who updates them and when.
Where the standards stand
The state of AI bill of materials standards is still moving. Check the version of the specification your tool emits and confirm your recipient can read it. Our post on SBOM for AI and ML models tracks the formats.
Try it yourself
Open the demo and see how components are listed with versions and relationships. A model entry belongs in the same kind of list.
Click through it at your own pace, or open it full screen.
Safeguard generates SBOMs and scans dependencies. If you need model entries, check the current export options against your recipient's requirements before committing. The free scan at gold.safeguard.sh/scan shows what a standard SBOM includes today.
Quick check
Is an ML-BOM legally required?
This post gives no legal advice. Requirements vary by jurisdiction and buyer, so check the text that applies to you.
Can we start with a spreadsheet?
Yes. A dated list of models with source, version and owner is a sound start and converts to a standard format later.
Sources
Last reviewed: 19 October 2026.
