As AI applications become deeply embedded in enterprise software systems, CIOs are striving to clarify how these tools generate output results. An AI Bill of Materials (AIBOM) can provide a valuable starting point for this.

Similar to a Software Bill of Materials (SBOM), an AIBOM is essentially an inventory record of all components involved in deploying an AI system. However, due to the complexity of AI itself, the pervasive embedding of tools in enterprise software, and the high frequency of updates, creating an AIBOM is not an easy task.

Although AIBOM is still a relatively new concept, Mark Smith, partner and principal software and AI analyst at ISG, said it is "not optional, unless you don't want to sleep well at night."

Ideally, an AIBOM should include a comprehensive inventory of the AI system, covering model versions, training datasets, dependencies, and model licensing information. Additionally, since AI models are typically continuously updated, the AIBOM also needs ongoing maintenance.

Researchers at the University of Salerno in Italy found that AIBOM "enhances the quality, traceability, management, and compliance of AI-enabled systems by documenting models, datasets, and their interrelationships." However, they also pointed out limitations of current AIBOMs, noting that "multiple challenges remain to be addressed, including immature generation and consumption tools, insufficient availability of data sources, poor interoperability with existing infrastructure, and limited stakeholder awareness."

IT leaders generally agree on the need for a tool to help clarify AI system outputs. Janet Worthington, senior analyst at Forrester, said: "Conceptually, people like the idea." However, obtaining accurate AIBOMs from vendors is not easy, especially when enterprises layer AI features on top of existing subscription software. She described it as somewhat of a "chicken-and-egg" dilemma, because it often takes the AI system itself to generate its own AIBOM.

Why investing in AIBOM is worthwhile

Kjell Carlsson, vice president analyst at Gartner, noted that having an AIBOM means CIOs can ideally "comprehensively audit and reproduce the output results of AI systems." This way, IT teams can diagnose and fix issues when they are identified.

When dealing with regulators, having detailed information is particularly critical—if problems arise, organizations can use it to explain the state of their AI assets and the measures they have taken.

Carlsson also believes that AIBOM will evolve based on the SBOM framework, because SBOM provides "a good framework that can be extended to the AI domain." But AIBOM needs to be more dynamic, because AI itself is constantly changing. He said: "Models are changing, and business use cases are evolving rapidly, which does not help solve the problem." Smith added that most CIOs "do not have full visibility into AI usage," creating a significant visibility gap.

How to get started building an AIBOM

Worthington said enterprises typically build AIBOMs internally to track vulnerabilities or dependencies and identify missing items. This is almost out of necessity, because AIBOM is far less prevalent than SBOM. But CIOs should still proactively request AIBOMs from vendors, especially when vendors integrate AI into purchased applications. Worthington cautioned: "Don't be surprised if they can't provide it right now, but it's a good starting point to open the conversation."

As AI regulation tightens, such conversations may become more urgent. With the implementation of the EU AI Act—which classifies AI by risk level and requires risk management, data governance, and technical documentation at each level—enterprises operating in the EU are closely monitoring this area.