For each dataset, an AI bill of materials should record where it came from, which exact version or hashes you used, its license, who approved it, when it was collected, and what you changed. OWASP recommends tracking data origins and transformations with CycloneDX or an ML bill of materials.
Why datasets belong in the inventory
A software bill of materials lists the components in a build. A model is also built from components, and the training and fine tuning data are among the most influential. If a dataset is later found to be poisoned, mislicensed or contaminated with sensitive records, you need to know which models used it. Without a record, that question takes weeks.
OWASP's guidance on data and model poisoning says to track data origins and transformations using tools like OWASP CycloneDX or ML-BOM, and to verify data legitimacy across development stages. Its supply chain entry adds that dataset licenses may restrict usage, distribution or commercialization.
Field list
| Field | Why it matters |
|---|---|
| Name and purpose | What the data is and what it was used for |
| Source address or supplier | Where it came from, for tracing |
| Version or snapshot identifier | Which exact state you used |
| File hashes | Detect later change, reproduce the run |
| Collection date | Date captured, useful for freshness and takedowns |
| License and terms | What you may do with it |
| Data owner | A person or team to ask |
| Sensitive content notes | Personal data, secrets, regulated records found or ruled out |
| Transformations | Filtering, deduplication, labeling, synthetic additions |
| Approver and date | Who accepted it into use |
| Consumers | Models, indexes or evaluations that used it |
The last row is the one teams forget. Linking a dataset to the models built from it is what turns a list into an answer.
Keep the entry small enough to maintain
A long form that nobody fills in is worse than a short one that is current. Start with source, version, hash, license, owner and consumers. Add the rest as the process matures. Make the entry part of the intake step, so a dataset cannot be used until its record exists.
Format
OWASP names CycloneDX and ML-BOM as ways to track provenance. Whatever format you choose, keep it machine readable and store it in the repository beside the pipeline code, so changes are reviewed and dated.
Updates and retirement
Datasets change. Add a new entry for every new version rather than editing the old one, and record when a dataset is retired and why. If a supplier tells you a source was compromised, you can search the records for every consumer and act.
For the model side of the same inventory, see what goes in an ML BOM for a model, and for the license fields, which license fields to record for a model and its datasets.
Quick check
Do I need entries for evaluation datasets?
Yes. They shape which model you choose and whether you notice a regression, so a tampered evaluation set misleads decisions.
Who should own the dataset inventory?
Usually the team that runs the training or retrieval pipeline, with security and legal reviewing the high risk entries.
Sources
Last reviewed: 19 October 2026.
