What is an AIBOM? AI bill of materials explained for security teams | Endor Labs

What it is

An Endor Labs explainer on the AI bill of materials (AIBOM) as an extension of the SBOM, not a replacement. It is a vendor post, and it states that no single AIBOM schema is universally adopted yet. Its advice is to use the format your customers and tooling already use, such as CycloneDX.

How it works

The page's worked example is an internal support assistant: a fine-tuned open-weight chat model, an embedding model, a self-hosted vector database, a hosted LLM API fallback and one MCP server. The fine-tuned model's CycloneDX entry uses these fields:

• type: machine-learning-model
• a SHA-256 hash of the adapter weights
• a license
• a pedigree.ancestors block that points to the base model by a purl pinned to a commit
• a modelCard that references the fine-tuning dataset

The pedigree link is what lets you answer "are we affected?" if the base model is later found to have a problem. The page says to validate the snippet against the current CycloneDX schema before use.

CISA and G7 guidance (May 2026), Software Bill of Materials for AI: Minimum Elements, groups AI SBOM data into seven clusters: metadata, system-level properties, models, dataset properties, infrastructure, security properties and key performance indicators. It is voluntary and sits on top of CISA's general SBOM minimum elements.

What to do

• Record unknowable fields as "unknown", never blank. A blank field makes the inventory look complete when it is not.
• For a hosted model API, which has no hash, record the exact model identifier, the date you verified it and the contract terms.
• For a base model with partial training-data lineage, record what the model card states and flag the gap.
• Pin models to a commit or digest, and record the source registry, license and base model for every fine-tune.
• Regenerate the AIBOM in CI/CD and ML pipelines whenever a model is downloaded, fine-tuned, promoted or replaced. An AIBOM from training time can differ from one at deployment.
• Check new entries against a policy of acceptable models, licenses and sources before they ship.
• To see a real example, run the OWASP AIBOM Generator on a Hugging Face model you already use. It emits CycloneDX and gives a completeness score.

The page's test for a working program: if an auditor asks for your AI inventory tomorrow, can you export it in minutes?

Caveats

• The page says most everyday risk is not malicious. Examples are unpinned models, deprecated versions still running, licenses that forbid commercial use and fine-tunes with no recorded base. Pickle-based model formats can execute code on load, which is why safetensors exists. The authors found no credible aggregate data on how often incidents are malicious.
• The EU AI Act and ISO/IEC 42001 do not name an AIBOM. An AIBOM only helps assemble the component and data evidence they expect.
• An AIBOM does not prove a model is safe, capture runtime behavior or record AI coding agent actions. Those need evaluation, runtime monitoring and agent audit logs with deterministic policy.