AN-051 Build guides · cluster
What Is an "AI Bill of Materials"? (Hardware vs Software Meanings)
AI bill of materials means two things: an AIBOM inventory of models and datasets, or a hardware BOM built with AI tools. What each holds, how to start.
by the HardwareMap editors4 min read
Contents
An AI bill of materials means one of two things, and search results mostly mean the first. In software security, an AI bill of materials (AIBOM, or ML-BOM) is an inventory of the models, datasets and dependencies inside an AI system. In hardware, it means a parts BOM drafted or managed with AI tools. This note covers both. For a conventional BOM, see the bill of materials example.
Meaning 1: the AI bill of materials in software security
An AIBOM is the AI extension of the software bill of materials (SBOM). An SBOM lists every software component and version so a security team can answer "are we exposed?" when a vulnerability lands. The US NTIA set out minimum elements for an SBOM in 2021, and CISA now carries that work.
Models break the SBOM's assumptions. A model is not just a package with a version. It has a training dataset, a base model it was fine-tuned from, a license that may differ from its code, evaluation results and known failure modes. An AIBOM records those so the next team, auditor or customer can trace where a model came from.
Typical AIBOM fields:
The AIBOM standards: CycloneDX and SPDX
Two formats dominate, both open:
- CycloneDX ML-BOM. OWASP CycloneDX added machine learning support in version 1.5, released June 2023. Its ML-BOM capability describes datasets, models and configurations, and it standardizes model cards inside the BOM. CycloneDX is also published by Ecma International as ECMA-424.
- SPDX 3.0 AI and Dataset profiles. The Linux Foundation's SPDX 3.0, released in April 2024, split AI documentation into an AI profile for models and a Dataset profile for data. The SPDX project also publishes a guide to implementing an AI BOM.
Which to pick usually follows your existing tooling. If your security scanner already emits CycloneDX SBOMs, extend them. If your legal team runs SPDX for license compliance, use the SPDX profiles.
Meaning 2: AI-built bills of materials for hardware
The second meaning is what a hardware founder usually wants: software that drafts, cleans or maintains a parts BOM. The jobs it is useful for:
- Extraction. Pull a parts list from a schematic netlist, a PDF drawing or a CAD assembly tree.
- Normalization. Turn "10k 0402 1%" and "RES 10K OHM 1% 1/16W 0402" into one consistent line.
- Part matching. Map generic values to manufacturer part numbers and find drop-in alternates.
- Enrichment. Attach price breaks, stock, lifecycle status and compliance data (RoHS, REACH).
- Change checks. Compare two revisions and flag what moved.
Where it fails, and what to check:
How to start either kind of AI bill of materials
For an AIBOM, start from what you already ship:
- List every model in production. Include third-party APIs, not only weights you host. A model called over an API is still a dependency.
- Record lineage at training time. Dataset versions, base model and fine-tuning configuration are cheap to capture when the run happens and expensive to reconstruct later.
- Generate, do not hand-write. Emit the CycloneDX or SPDX document from your training and release pipeline so it changes when the model does.
- Store it with the release. One AIBOM per shipped model version, kept next to the SBOM for the same build.
For an AI-drafted hardware BOM, start from a source of truth. Export the netlist or CAD assembly tree first, let the tool normalize and enrich it, then reconcile the result against the physical prototype. Split it into the engineering view and the manufacturing bill of materials your factory builds from, because AI tools usually stop at the first. Terms such as MPN, AVL and ECO are defined in the hardware startup glossary.
The rule: AI drafts, an engineer signs. The BOM that reaches a contract manufacturer is a controlled document, and our note on bill of materials management covers revisions and change orders. Tools that do this work are compared in bill of materials software.
When a hardware product needs both
An edge device that runs a model on board carries three inventories: a hardware BOM for parts, an SBOM for firmware and an AI bill of materials for the model. CycloneDX covers the first with its HBOM capability, so a single standard can describe the whole device. Startups building AI silicon and edge compute sit in the silicon category, which lists 44 companies in the index as of REV 26.09.
Whether a buyer or regulator requires any of these depends on your market and contract. Ask early, because retrofitting provenance for a model trained a year ago is slow work.
Frequently asked questions
What is an AIBOM?
An AIBOM, or AI bill of materials, is a machine-readable inventory of the parts of an AI system: models, their versions and sources, training and evaluation datasets, software dependencies, licenses and known limitations. It extends the software bill of materials idea to machine learning. The two main formats are CycloneDX, which added ML-BOM support in version 1.5, and SPDX 3.0, which has AI and Dataset profiles.
Is an AIBOM the same as an SBOM?
No, but it is built on the same idea and often in the same file. An SBOM lists software packages and versions. An AIBOM adds what an SBOM cannot express well: model lineage, training data provenance, intended use, performance metrics and ethical or safety notes. CycloneDX and SPDX both let you combine the two, so one document can describe the code and the models it runs.
Can AI generate a bill of materials for my hardware product?
AI tools can draft one. They extract parts from schematics and CAD exports, normalize descriptions, match manufacturer part numbers, suggest alternates and pull price and lifecycle data. They also make confident mistakes: wrong package suffixes, invented part numbers and missing mechanical lines. Treat the output as a draft that an engineer checks line by line before it goes to a buyer.
Does a hardware product with an AI model need both kinds of BOM?
If the device runs a model on board, it has a hardware BOM for the parts, a software BOM for the firmware and, increasingly, a model inventory for the AI components. CycloneDX covers all three in one standard through its HBOM, SBOM and ML-BOM capabilities. Whether a customer or regulator requires the model inventory depends on the market, so check with the buyer and counsel.
HardwareMap catalogues hardware startups like parts on a datasheet. Building one? Submit it and get a part number.
Building one?
Submit it to the index and get a part number. Every entry is reviewed by hand.