Watch
Season 3
Episode 9

AI-BOM Generator: List Models and Dependencies in Your AI

An AI-BOM, or AI bill of materials, is a machine-readable inventory of the models, datasets and dependencies inside an AI system: a structured parts list for the AI in a product. Since v0.2.0 (9 November 2026), the free aigovchain aibom command builds one from AI_GOVERNANCE.md and the project dependencies, in CycloneDX 1.6 or SPDX 3.0.1 with its AI and Dataset profiles.

S3E9 poster: What'S Inside Your Ai?. AI-BOM generator: live since v0.2.0.

Video not out yetRead the script

The video episode is not out yet.The script is below. The feature it shows is live since v0.2.0.

S3E9 · What's Inside Your AI? · Season 3: The Commons · script for an episode of about 3 minutes. Script and sources by Mathieu K. Gouanou. Not legal advice. Command checked against v0.2.0 on 9 November 2026; standards facts checked the same day.

Links of the chain in this episode: Control, Evidence

In one line

Which models are inside your product? A list others can review beats a guess.

Times are estimates until the episode is out.

Key fact

CycloneDX added machine-learning BOM support in version 1.5, released on 26 June 2023. SPDX 3.0, released on 16 April 2024, added AI and Dataset profiles.

Source

Try it

1. Declare the models your system uses in the models section of AI_GOVERNANCE.md. No AI_GOVERNANCE.md yet? Run init first.

models:
  - name: "Example model"
    provider: "Example provider"
    version: "2026-10"
    model_card: "https://example.com/model-card"
    datasets: ["Example training data"]

2. Generate the AI-BOM in CycloneDX 1.6 (aibom.cdx.json). It also reads package.json and requirements.txt; add --no-deps to skip them.

npx github:mathieugouanou/aigovernancechain aibom

3. Or write SPDX 3.0.1 with the AI and Dataset profiles (aibom.spdx3.json)

npx github:mathieugouanou/aigovernancechain aibom --format spdx

The tool

Changelog: v0.2.0, the AI-BOM generator AI_GOVERNANCE.md spec: the models field and section 3.2, AI-BOM CycloneDX: machine-learning BOM SPDX 3.0.1: AI and Dataset profiles

Season 3: The Commons

Season 3 is about who holds the chain: small teams, open lists and shared evidence. Each episode shows one feature and its limits.

The script

The script of this episode as of 9 November 2026, ahead of the video. The wording may change slightly when it is recorded. Numbers are written as digits. Sources are listed below the script.

0:00AI-BOM: what sits inside?

Welcome! Which models are inside your product? Prove it. AI Governance Chain has an AI-BOM generator that turns declared models and dependencies into a machine-readable inventory.

0:22The buyer's model inventory

Picture an enterprise buyer sending a supplier questionnaire on Friday. One question asks for every AI model and dataset in your product. The product team opens a spreadsheet. One model entry is old, and nobody knows what else changed. The buyer needs a list they can review, not a guess assembled at the last minute.

0:45What an AI-BOM records

An AI-BOM is a machine-readable inventory of the models, datasets and dependencies inside an AI system. In plain words, it is a structured parts list for the AI in a product. The generator reads declared models from AI_GOVERNANCE.md and the project dependencies. On the chain, this connects CONTROL to EVIDENCE: what the team declares becomes a record others can inspect. It extends a software bill of materials to AI.

1:13Create a CycloneDX or SPDX file

Step 1: open the models section of AI_GOVERNANCE.md and declare the system models. Step 2: include the project dependencies. Step 3: run aigovchain aibom to create the inventory. Since v0.2, released on 9 November 2026, the generator writes 2 formats: CycloneDX 1.6 and SPDX 3.0.1 with its AI and Dataset profiles. CycloneDX's machine-learning BOM support arrived in version 1.5 in June 2023. Ecma International publishes CycloneDX as the standard ECMA-424. SPDX 3.0, released in April 2024, includes AI and Dataset profiles.

1:49Who uses the AI-BOM?

Procurement teams can send the inventory with a supplier response. Developers can compare declared models with project dependencies. Risk teams can review the components recorded for a use case. Product owners can make the model list visible during a change review.

2:06Limits of a model inventory

The generator lists declared components. It cannot prove a model was actually used or that a dataset is authorised. Missing entries stay missing, and old entries can become stale. This is an inventory, not an audit, and it is governance guidance, not legal advice in any jurisdiction. Keep the models section current and check the source files. A machine-readable file can sit beside the product records used in a supplier review.

2:33Generate your AI-BOM

Your one action: generate an AI-BOM from your models section with aigovchain aibom, linked below.

You can list what's inside. Can you prove nobody edited the evidence afterwards?

Thank you for watching!

Short answers

What is an AI-BOM?

A machine-readable inventory of the models, datasets and dependencies inside an AI system. It extends a software bill of materials (SBOM) to AI.

Can I generate an AI-BOM with AI Governance Chain today?

Yes, since v0.2.0 (9 November 2026). Run aigovchain aibom for CycloneDX 1.6, or add --format spdx for SPDX 3.0.1 with its AI profile, plus the Dataset profile when you declare datasets. It reads the models section of AI_GOVERNANCE.md and, unless you pass --no-deps, package.json and requirements.txt.

Which formats exist?

CycloneDX has supported machine-learning BOMs since version 1.5 (June 2023); Ecma International publishes CycloneDX as ECMA-424 (1st edition June 2024, 2nd edition December 2025). SPDX 3.0 (April 2024) has AI and Dataset profiles; the current version is SPDX 3.0.1. The generator writes CycloneDX 1.6 and SPDX 3.0.1.

Does an AI-BOM prove which models were used?

No. It lists declared components. It cannot prove that a model was actually used or that a dataset is authorised. Not legal advice.

Questions this episode answers

What is an AI-BOM?Answered in 0:45: What an AI-BOM records
How do I answer a buyer who asks for every AI model in our product?Answered in 0:22: The buyer's model inventory
Can I generate an AI-BOM with AI Governance Chain today?Answered in 1:13: Create a CycloneDX or SPDX file
Does CycloneDX support machine-learning models?Answered in 1:13: Create a CycloneDX or SPDX file
Does SPDX 3.0 have an AI profile?Answered in 1:13: Create a CycloneDX or SPDX file
What can an AI-BOM not prove?Answered in 2:06: Limits of a model inventory