AIBOM Generator — AI Bill of Materials for Compliance & Supply Chain Security

📋 The EU AI Act requires transparency. Your AI systems must have a bill of materials. Do you know what’s inside your AI applications?

Traditional SBOMs track software dependencies. But AI systems have different components: models, prompts, training datasets, embeddings, vector stores. These are invisible to standard SBOM tools.

AegisGate AIBOM Generator fills this gap. Automatically generate CycloneDX 1.6+ compliant AI Bill of Materials that tracks every AI component in your systems.

The AI Transparency Problem

Regulators worldwide are demanding AI transparency:

The challenge: AI systems are opaque. You might know you’re using GPT-4, but:

• Which prompts are sent to the model?
• What training data was used to fine-tune it?
• Which embeddings are stored in your vector database?
• What version of the model is running in production?

Without this information, you cannot:

• Demonstrate compliance with EU AI Act
• Assess supply chain risks (what if the model provider changes terms?)
• Respond to incidents (which systems are affected by a model vulnerability?)
• Answer auditor questions (what data trained this model?)

The AIBOM Solution

AegisGate AIBOM Generator automatically creates AI Bill of Materials in CycloneDX 1.6+ format:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "version": 1,
  "metadata": {
    "timestamp": "2026-08-14T09:30:00Z",
    "component": {
      "type": "application",
      "name": "customer-support-chatbot",
      "version": "2.1.0"
    }
  },
  "components": [
    {
      "type": "ai-model",
      "name": "gpt-4",
      "provider": "OpenAI",
      "version": "gpt-4-0613",
      "modelCard": "https://openai.com/gpt-4-model-card",
      "parameters": "1.76T",
      "architecture": "transformer"
    },
    {
      "type": "ai-prompt",
      "name": "system-prompt-v3",
      "hash": "SHA256:a1b2c3d4e5f6...",
      "template": "You are a customer support assistant..."
    },
    {
      "type": "dataset",
      "name": "customer-faq-2026",
      "version": "2026.01",
      "size": "2.3GB",
      "license": "proprietary"
    },
    {
      "type": "ai-embedding",
      "name": "text-embedding-ada-002",
      "provider": "OpenAI",
      "dimension": 1536,
      "vectorStore": "pinecone"
    }
  ],
  "signature": "MEUCIQDvL8K9mN2pQ3rS4tU5vW6xY7zA8bC9dE0fG1hI2jK3lM4n"
}

Key Properties:

• CycloneDX 1.6+ compliant (emerging standard for AI SBOMs)
• Byte-stable (identical input = identical output, verifiable)
• Cryptographically signed (tamper-evident)
• Automatically generated (no manual documentation required)

What AIBOM Tracks

AI Models

{
  "type": "ai-model",
  "name": "llama-3-70b",
  "provider": "Meta",
  "version": "3.0",
  "parameters": "70B",
  "architecture": "transformer",
  "quantization": "INT8",
  "license": "llama-3-community",
  "modelCard": "https://llama.meta.com/model-card",
  "purl": "pkg:aibom/meta/llama-3-70b@3.0"
}

Tracked Properties:

• Model name and version
• Provider/developer
• Parameter count
• Architecture type
• Quantization (if applicable)
• License terms
• Model card URL
• Package URL (purl) for dependency tracking

Prompts & Templates

{
  "type": "ai-prompt",
  "name": "system-prompt-customer-support",
  "hash": "SHA256:7d8a9b2c4e5f6a1b3c4d5e6f7a8b9c0d",
  "template": "You are a customer support assistant for Company X...",
  "version": "3.2",
  "createdAt": "2026-01-15T09:00:00Z",
  "updatedAt": "2026-08-10T14:30:00Z"
}

Tracked Properties:

• Prompt hash (for integrity verification)
• Template content (for audit)
• Version history
• Creation/modification timestamps
• Author (if available)

Training Datasets

{
  "type": "dataset",
  "name": "customer-support-training-data",
  "version": "2026.01",
  "size": "2.3GB",
  "recordCount": 150000,
  "license": "proprietary",
  "source": "internal",
  "piiContent": false,
  "hash": "SHA256:b2c3d4e5f6a1..."
}

Tracked Properties:

• Dataset name and version
• Size and record count
• License terms
• Source (internal, third-party, public)
• PII content flag (for GDPR/HIPAA compliance)
• Cryptographic hash

Embeddings & Vector Stores

{
  "type": "ai-embedding",
  "name": "text-embedding-ada-002",
  "provider": "OpenAI",
  "dimension": 1536,
  "vectorStore": "pinecone",
  "indexName": "customer-faq-index",
  "recordCount": 50000
}

Tracked Properties:

• Embedding model name
• Provider
• Vector dimension
• Vector store system
• Index name
• Record count

Use Cases

EU AI Act Compliance

Requirement: Article 50 requires technical documentation for high-risk AI systems.

AIBOM Solution:

• AIBOM provides structured technical documentation
• Tracks all AI components (models, prompts, data)
• CycloneDX format is regulator-acceptable
• Cryptographic signature ensures document integrity

Compliance Mapping:

• EU AI Act Article 50: Technical documentation
• Annex III: High-risk AI system classification
• Annex IV: Technical documentation requirements

Supply Chain Risk Management

Problem: Your AI model provider changes terms, shuts down, or has a security incident.

AIBOM Solution:

• AIBOM lists all AI dependencies with provider information
• You can quickly assess impact (which systems use this model?)
• Alternative models can be evaluated (what are the substitutes?)
• License terms are tracked (are you compliant?)

Example:

GPT-4 terms change → Query AIBOM → 12 systems affected → Plan migration

Incident Response

Problem: A vulnerability is disclosed in a popular AI model (e.g., prompt extraction attack).

AIBOM Solution:

• Query AIBOM for affected models
• Identify all systems using vulnerable model
• Prioritize remediation based on system criticality
• Demonstrate due diligence to regulators

Example:

CVE-2026-12345 (GPT-4 prompt extraction) → 
  Query AIBOM → 
  8 production systems affected → 
  Emergency patching initiated

Auditor Requests

Problem: Auditor asks: “What data trained your customer support chatbot?”

AIBOM Solution:

• Export AIBOM in PDF/JSON format
• Provide to auditor (cryptographically signed)
• Auditor can verify integrity (no tampering)
• Request satisfied in minutes, not days

Example:

Auditor: "Show me your AI system documentation"
You: [Exports AIBOM PDF]
Auditor: [Verifies signature] "Thank you. This is complete."

API Reference

Generate AIBOM

POST /api/v1/aibom/generate
Content-Type: application/json
Authorization: Bearer <api_key>

{
  "system_id": "customer-support-chatbot",
  "version": "2.1.0",
  "includePrompts": true,
  "includeDatasets": true,
  "includeEmbeddings": true
}

Response:

{
  "aibom_id": "aibom-2026081409300001",
  "system_id": "customer-support-chatbot",
  "version": "2.1.0",
  "generated_at": "2026-08-14T09:30:00Z",
  "format": "cyclonedx-1.6",
  "component_count": 12,
  "signature": "MEUCIQDvL8K9mN2pQ3rS4tU5vW6xY7zA8bC9dE0fG1hI2jK3lM4n",
  "download_url": "/api/v1/aibom/aibom-2026081409300001/download"
}

Download AIBOM (JSON)

GET /api/v1/aibom/{aibom_id}/download?format=json
Authorization: Bearer <api_key>
Accept: application/json

Response: CycloneDX 1.6+ JSON (ready for integration)

Download AIBOM (PDF)

GET /api/v1/aibom/{aibom_id}/download?format=pdf
Authorization: Bearer <api_key>
Accept: application/pdf

Response: PDF document (regulator-ready format)

Verify AIBOM Signature

POST /api/v1/aibom/verify
Content-Type: application/json

{
  "aibom_file": "...",
  "signature": "MEUCIQDvL..."
}

Response:

{
  "verified": true,
  "integrity": "intact",
  "timestamp": "2026-08-14T09:30:00Z"
}

List Historical AIBOMs

GET /api/v1/aibom/systems/{system_id}?limit=10
Authorization: Bearer <api_key>

Response:

{
  "aiboms": [
    {
      "aibom_id": "aibom-2026081409300001",
      "version": "2.1.0",
      "generated_at": "2026-08-14T09:30:00Z"
    },
    {
      "aibom_id": "aibom-2026070109000001",
      "version": "2.0.0",
      "generated_at": "2026-07-01T09:00:00Z"
    }
  ]
}

Tier & Availability

Minimum Version: Platform v4.2.0+

CycloneDX 1.6+ Compliance

AegisGate AIBOM Generator is fully compliant with CycloneDX 1.6+ AI extension:

Why CycloneDX matters:

• Emerging industry standard (OWASP project)
• Recognized by regulators (EU AI Act, NIST)
• Tool ecosystem (dependency-track, cyclonedx-cli)
• Future-proof (versioned standard)

Competitive Comparison

Bottom line: AegisGate is the only AIBOM generator with CycloneDX 1.6+ AI extension support and cryptographic integrity.

Frequently Asked Questions

Ready to Document Your AI Systems?

AIBOM Generator is available in Developer tier and above.

Start Free Trial → Technical Documentation → Contact Sales →