Models
Which models are used, where they came from, their versions and how they were fine-tuned.
An AI bill of materials is the ingredient list for an AI system. It is the foundation for securing, governing and proving the AI you run.
An AI‑BOM, or AI bill of materials, is a structured inventory of everything that makes up an AI system: its models, the data used to train and run them, the code and frameworks around them, the infrastructure they depend on and the processes that produce them.
Where a software bill of materials (SBOM) lists code components, an AI‑BOM captures the AI-specific parts that SBOM tools cannot detect.
Think of it as an exploded view of an AI system: every layer, recorded and traceable.
Which models are used, where they came from, their versions and how they were fine-tuned.
The datasets behind training, fine-tuning, evaluation and retrieval, with their sources.
The AI libraries, SDKs and agent frameworks the system relies on.
Where the system runs: cloud services, endpoints and hosting.
How the system is built and changed, and who is accountable for it.
Known vulnerabilities and assessment results linked to the components they affect.
They are complementary. Most organizations need both, because each answers a different question.
| SBOM | AI‑BOM | |
|---|---|---|
| Focus | Software components and packages | AI models and their data, infrastructure and processes |
| Answers | What code is in this application? | What AI is in this system, and what is it made of? |
| Detects AI components | No | Yes |
| Supports | Software supply chain security | AI supply chain risk, AI governance and AI compliance |
An AI‑BOM turns shadow AI into a known, owned inventory, the first step of the AI Trust Loop.
See DiscoverWhen a model or library is found to be unsafe, an AI‑BOM shows exactly which systems use it.
Frameworks such as the EU AI Act, NIST AI RMF and ISO 42001 expect you to know what your AI is built from.
Vendors can attach AI‑BOMs to Cranium AI Cards, so customers see what is inside the AI they buy.
See AI CardsDetect AI, CodeSensor, CloudSensor and AgentSensor find AI wherever it lives.
Cranium ONE builds AI‑BOMs from what it finds, one per repository.
Each AI‑BOM has an accountable owner, so every component has someone answerable for it.
CodeSensor does not scan infrastructure, so infrastructure components are added through self-attestation.
Attach AI‑BOMs to AI Cards to prove posture to auditors, customers and partners.
Straight answers, kept current. Last updated .
Ask us anything →An AI‑BOM, or AI bill of materials, is a structured inventory of an AI system’s models, data, code, infrastructure and processes.
An SBOM lists software components. An AI‑BOM covers AI models and their data, infrastructure and processes. SBOM tools cannot detect AI components, so an SBOM alone leaves AI out.
AI bill of materials. You will also see it written as AIBOM or AI BOM.
In Cranium ONE, AI‑BOMs are generated per repository, each with an assigned owner, so larger organizations typically have many.
Yes. Cranium ONE generates AI‑BOMs automatically from what Detect AI, CodeSensor, CloudSensor and AgentSensor discover. Infrastructure components that are not scanned are added through self-attestation.
Security teams use it to find exposure, governance and compliance teams use it as evidence, and vendor-risk teams request it from suppliers through AI Cards.
See how Cranium ONE discovers your AI and builds AI‑BOMs automatically.
We use essential cookies to run this site, and — only with your permission — analytics and marketing cookies to improve it. You're the hero here; you stay in control. Privacy Policy.