Build the inventory in four layers: Python packages, system and container packages, model and data artifacts, and the notebooks and scripts that tie them together. A package list alone misses the files most likely to surprise you, such as a downloaded checkpoint.
Why ML needs a wider list
A web service mostly depends on libraries. An ML project depends on libraries and on files fetched at runtime: weights from a hub, tokenizers, datasets, and remote code. If those do not appear in your inventory, nobody reviews them.
The four layers
| Layer | Examples | How to capture it |
|---|---|---|
| Packages | Frameworks, numerical libraries, data tools | Lock file with exact versions and hashes |
| Environment | Base image, CUDA libraries, OS packages | Image manifest or container scan |
| Artifacts | Model weights, tokenizers, datasets, checkpoints | A register with source, commit, format, hash |
| Glue | Notebooks, training scripts, CI jobs | Repo scan for loaders and installs |
Steps
- Freeze the packages. Resolve in a clean environment and write exact versions. Include transitive dependencies.
- Record the base image. Name the tag or digest, not "latest".
- Search for artifact loads. Find every place code downloads or opens a model or dataset.
- Register each artifact. Capture where it came from, the pinned commit or version, the file format, the SHA-256, who approved it and when.
- List notebook installs. Cells with pip install lines are dependencies too.
- Assign owners. Every row needs a person or team.
- Refresh on a schedule, and on every pull request that touches requirements or loading code.
grep -rnE "from_pretrained|torch.load|load_model|pickle.load|hf_hub_download|trust_remote_code|pip install" .
Treat the output as a map of where your project reaches outside itself.
A minimal artifact register
name: sentiment-model
source: org-name/sentiment-model
revision: <full commit hash>
format: safetensors
sha256: <hash>
owner: ml-platform
approved: 2026-10-19
Use a standard when others need to read it
If customers or auditors ask for your inventory, a standard format helps. CycloneDX describes ML-BOM as a bill of materials for AI and machine learning that represents models, datasets and configurations. See what an ML-BOM should include for a field list.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a flat package list turns into direct and transitive entries, then think about which rows in your own project have no owner.
Where Safeguard fits
Safeguard generates SBOMs and scans dependencies, and its reachability analysis shows which vulnerable packages your code actually uses. A free scan is available at gold.safeguard.sh/scan.
Quick check
Do notebooks belong in the inventory?
Yes. Install cells and model loading cells bring in code and files that never appear in a lock file.
How often should the inventory be refreshed?
On every change to requirements or model loading code, plus a scheduled review so quiet projects do not go stale.
Sources
Last reviewed: 19 October 2026.
