A new standard for AI transparency: AIBOM
AI systems need their own bill of materials. Here's why AIBOM is becoming that standard.
TL;DR: An AI Bill of Materials (AIBOM) is a structured inventory of an AI system's components, including models, training data, software dependencies and hardware. AIBOMs aren't mandatory yet, but G7 cybersecurity agencies published joint minimum elements for them in May 2026, and CycloneDX and SPDX already support the format.
AIBOM isn't a formal requirement yet. It's also becoming hard to imagine AI governance without one.
An AIBOM inventories the components behind an AI system
An Artificial Intelligence Bill of Materials (AIBOM) is a structured inventory of an AI system's components: model architecture, training data sources, software dependencies and hardware specifications. Where an SBOM documents software components and a CBOM documents cryptographic elements, an AIBOM documents the parts specific to how an AI system functions, which is where its risk actually lives.
CycloneDX and SPDX already support AIBOMs
AIBOM has no single mandated format, but the two main SBOM standards already cover it. CycloneDX added machine learning bill of materials (ML-BOM) support in version 1.5, and SPDX 3.0 includes an AI profile. Both let an organisation record models and datasets in the same document as the software they ship with.
G7, EU and Chinese rules all point towards AI documentation
Regulators are moving towards AI documentation from several directions. In May 2026, CISA and its G7 partners (Germany, Canada, France, Italy, Japan, the UK and the EU) published joint guidance, Software Bill of Materials for AI – Minimum Elements, setting out what an AI-specific bill of materials should record on top of a standard SBOM. The guidance is voluntary, but it gives AIBOMs a shared baseline across the G7 and the EU. The EU's AI Act includes provisions pushing towards greater AI accountability, and China has introduced its own measures aimed at more transparency in model development and deployment. All of these share one assumption: organisations need a structured way to say what's actually in their AI systems, not just that the systems exist.
Banks and healthcare providers already document their AI models
Private-sector organisations face scrutiny over model transparency, data privacy and compliance regardless of jurisdiction. Banks are documenting AI models used for credit risk assessments to meet fair lending requirements. Healthcare AI used in diagnostics needs a defensible record of training data and decision logic to satisfy regulatory review. In both cases, the need is a record that can be produced and defended, not reconstructed after the fact.
Reputation adds to the pressure. As public scrutiny of AI bias, ethical risk and security vulnerabilities grows, organisations without a transparency record are the ones left explaining after something has already gone wrong.
Building an AIBOM practice now avoids a scramble later
AIBOM isn't a formal requirement today, and the G7 minimum elements are explicitly voluntary. Organisations that build AIBOM practices before the requirement lands are the ones positioned to meet it without a scramble. The open question is when AIBOMs become standard, not whether.