Glossary

AI Bill of Materials (AI-BOM)

What Is an AI Bill of Materials (AI-BOM)?

An AI Bill of Materials (AI-BOM) is an inventory of the AI-related components inside a software artifact — models, frameworks, training datasets where known, providers, and structural details — used to bring AI artifacts into the same governance, compliance, and risk workflows that exist for traditional software components.

AI in shipped software is no longer hypothetical. Models are embedded in firmware, container images, and applications across nearly every industry. Without an AI-BOM, those artifacts remain invisible to security teams — outside the SBOM, outside license workflows, outside compliance reviews.

NetRise's AI Models and Components Identification capability brings AI artifacts into the standard SBOM, with provider attribution and model details where available.

Software Supply Chain ConceptsVulnerability Exploitability eXchange (VEX)VEX is a standardized format for communicating whether a vulnerability in a software component is actually exploitable in a given product — filtering noise from risk.Read definition
Software Supply Chain ConceptsSoftware MaintainerA software maintainer is the individual or group responsible for an open-source project's code, releases, and direction — its stewardship over time.Read definition
Software Supply Chain ConceptsDirect DependencyA direct dependency is a software component an application explicitly declares in its own manifest or source — chosen by the developer, not pulled in downstream.Read definition

AI Bill of Materials (AI-BOM)

What Is an AI Bill of Materials (AI-BOM)?

Related Terms

Related Content