AI Bill of Materials (AI BOM)

AI Bill of Materials (AI BOM) provides complete visibility into your AI model inventory, dependencies, data flows, and compliance requirements.

What is AI BOM?

AI BOM is a comprehensive inventory of:

• Models - LLMs, fine-tuned models, embeddings used
• Dependencies - Framework versions, libraries, data sources
• Risks - Vulnerabilities, licensing issues, compliance gaps
• Exports - Standard formats (CycloneDX, SPDX, SARIF, Markdown)

Key Information Captured

1
AI BOM:
2
  models:
3
    - name: GPT-4
4
      version: "1106"
5
      provider: OpenAI
6
      purpose: General chat
7
      data_flows: [customer_input, internal_docs]
8
      license: Proprietary
9
      risks: [API_limit_reached, high_cost]
10
11
  dependencies:
12
    - package: langchain
13
      version: "0.1.0"
14
      license: MIT
15
      vulnerabilities: []
16
    - package: openai-python
17
      version: "1.3.5"
18
      license: MIT
19
      vulnerabilities: [CVE-2024-1234]
20
21
  data_flows:
22
    - source: customer_input
23
      model: GPT-4
24
      destination: response
25
      compliance_requirements: [GDPR, CCPA]
26
27
  compliance:
28
    frameworks: [SOC2, HIPAA]
29
    status: 85% compliant
30
    gaps: [audit_logging_incomplete, no_data_retention_policy]

How AI BOM Works

Automated Discovery

GovernanceAI scans your codebase to automatically discover:

Git Repository
├─ .github/workflows/*.yml → GitHub Actions scanning LLMs
├─ requirements.txt → Python dependencies and versions
├─ package.json → Node.js packages
├─ Dockerfile → Container base images
├─ src/ → Code references to LLM calls
└─ docs/ → Model usage documentation

Example Detection:

1
# Your code
2
from openai import OpenAI
3
client = OpenAI(api_key=os.getenv("OPENAI_API_KEY"))
4
response = client.chat.completions.create(
5
    model="gpt-4-turbo",
6
    messages=[{"role": "user", "content": "..."}]
7
)

AI BOM automatically detects:

• ✅ Model: GPT-4 Turbo
• ✅ Provider: OpenAI
• ✅ Framework: openai-python SDK
• ✅ Package versions
• ✅ Vulnerability: CVE-2024-1234 in openai==1.3.5

Risk Assessment

AI BOM categorizes risks:

Using AI BOM

View in Dashboard

• Inventories section
• Click AI BOM
• Browse discovered models and dependencies
• Filter by risk level, framework, provider
• View detailed information per model

Generate Reports

$
# Export as CycloneDX (SBOM standard)
$
curl -H "Authorization: Bearer $API_KEY" \
>
  https://api.governanceai.com/v1/ai-bom/export \
>
  -d '{"format": "cyclonedx"}' \
>
  > sbom.xml
$
$
# Export as SPDX (License compliance)
$
curl -H "Authorization: Bearer $API_KEY" \
>
  https://api.governanceai.com/v1/ai-bom/export \
>
  -d '{"format": "spdx"}' \
>
  > sbom.spdx.json
$
$
# Export as SARIF (Security findings)
$
curl -H "Authorization: Bearer $API_KEY" \
>
  https://api.governanceai.com/v1/ai-bom/export \
>
  -d '{"format": "sarif"}' \
>
  > findings.sarif
$
$
# Export as Markdown (Human readable)
$
curl -H "Authorization: Bearer $API_KEY" \
>
  https://api.governanceai.com/v1/ai-bom/export \
>
  -d '{"format": "markdown"}' \
>
  > inventory.md

CycloneDX Example

1
<?xml version="1.0" ?>
2
<bom xmlns="http://cyclonedx.org/schema/bom/1.3">
3
  <metadata>
4
    <component type="application">
5
      <name>My AI Application</name>
6
      <version>1.0.0</version>
7
    </component>
8
  </metadata>
9
  <components>
10
    <component type="library">
11
      <name>openai</name>
12
      <version>1.3.5</version>
13
      <purl>pkg:pypi/openai@1.3.5</purl>
14
      <vulnerabilities>
15
        <vulnerability ref="CVE-2024-1234">
16
          <rating>7.5</rating>
17
          <description>API key exposure in logs</description>
18
        </vulnerability>
19
      </vulnerabilities>
20
    </component>
21
  </components>
22
</bom>

Compliance Mapping

AI BOM maps your inventory against compliance frameworks:

SOC2 Type II Mapping

SOC2 Control: CC6.1 - Restrict logical access
├─ Requirement: Control who can access LLM APIs
├─ AI BOM Finding:
│  └─ openai SDK has hardcoded API key in config.py:45
├─ Status: VIOLATION
└─ Remediation: Move to environment variables
SOC2 Control: CC7.2 - Monitor system components
├─ Requirement: Log all LLM API calls
├─ AI BOM Finding:
│  └─ API call logging enabled ✓
├─ Status: COMPLIANT
└─ Evidence: 1.2M logged calls in past 30 days

HIPAA Mapping

HIPAA Rule: Privacy Rule (45 CFR § 164.504)
├─ Requirement: Encryption of ePHI in transit and at rest
├─ AI BOM Finding:
│  └─ GPT-4 API uses TLS 1.2+ ✓
│  └─ Prompts may contain patient names/IDs ⚠
├─ Status: PARTIALLY COMPLIANT
└─ Action: Add PII masking guardrail

Data Flow Tracking

AI BOM tracks where sensitive data goes:

User Input
  ├─ May contain: Name, Email, SSN
  │
  ├─ GPT-4 API Call
  │  └─ Data flows to OpenAI (USA)
  │  └─ Complies with: GDPR (standard contracts), CCPA
  │
  ├─ Embedding Model
  │  └─ Data flows to Pinecone (AWS)
  │  └─ Stored for vector search
  │
  └─ Logging System
     └─ Data flows to DataDog (EU)
     └─ Complies with: GDPR (sub-processor)

Automated Scanning

Schedule Scans

$
curl -X POST https://api.governanceai.com/v1/ai-bom/scans/schedule \
>
  -H "Authorization: Bearer $API_KEY" \
>
  -d '{
>
    "name": "Daily AI Inventory Scan",
>
    "schedule": "0 2 * * *",  # 2 AM daily
>
    "repositories": ["all"],
>
    "scan_options": {
>
      "include_dependencies": true,
>
      "check_vulnerabilities": true,
>
      "analyze_data_flows": true,
>
      "generate_report": true
>
    }
>
  }'

On-Demand Scan

$
curl -X POST https://api.governanceai.com/v1/ai-bom/scans \
>
  -H "Authorization: Bearer $API_KEY" \
>
  -d '{
>
    "repositories": ["repo_1", "repo_2"],
>
    "priority": "high"
>
  }'

Webhook Integration

Get notified when risks are detected:

$
# Configure webhook
$
curl -X POST https://api.governanceai.com/v1/webhooks \
>
  -H "Authorization: Bearer $API_KEY" \
>
  -d '{
>
    "event": "ai_bom.vulnerability_detected",
>
    "url": "https://your-domain.com/webhooks/ai-bom",
>
    "filters": {
>
      "severity": ["high", "critical"]
>
    }
>
  }'

Webhook payload:

1
{
2
  "event": "ai_bom.vulnerability_detected",
3
  "timestamp": "2024-01-15T10:30:00Z",
4
  "vulnerability": {
5
    "cve": "CVE-2024-1234",
6
    "package": "openai",
7
    "version": "1.3.5",
8
    "severity": "high",
9
    "description": "API key exposure in debug logs",
10
    "remediation": "Upgrade to 1.3.6 or later"
11
  }
12
}

Compliance Reports

Generate Compliance Report

$
curl -X POST https://api.governanceai.com/v1/reports/compliance \
>
  -H "Authorization: Bearer $API_KEY" \
>
  -d '{
>
    "frameworks": ["SOC2", "HIPAA"],
>
    "format": "pdf",
>
    "period": "Q1"
>
  }' \
>
  > compliance_report_q1.pdf

Report Contents

Compliance Report - Q1 2024
├─ Executive Summary
│  ├─ Overall compliance: 85%
│  ├─ Critical gaps: 3
│  └─ Trend: +5% from Q4
├─ Framework Details
│  ├─ SOC2: 92% compliant
│  │  └─ 1 control violation
│  ├─ HIPAA: 78% compliant
│  │  └─ 5 control violations
│  └─ GDPR: 89% compliant
│     └─ 2 control violations
├─ Finding Details
│  ├─ High: Unencrypted API keys in logs
│  ├─ Medium: Missing audit logging
│  └─ Low: Old package versions
└─ Recommendations
   ├─ Immediate: Rotate API keys
   ├─ This week: Enable audit logging
   └─ This month: Update dependencies

Integration with CI/CD

GitHub Actions Example

1
name: AI BOM Scan
2
3
on: [push, pull_request]
4
5
jobs:
6
  ai-bom-scan:
7
    runs-on: ubuntu-latest
8
    steps:
9
      - uses: actions/checkout@v3
10
11
      - name: Scan with GovernanceAI
12
        run: |
13
          curl -X POST https://api.governanceai.com/v1/ai-bom/scans \
14
            -H "Authorization: Bearer ${{ secrets.GOVERNANCEAI_API_KEY }}" \
15
            -d '{
16
              "repository": "${{ github.repository }}",
17
              "ref": "${{ github.ref }}"
18
            }'
19
20
      - name: Check Results
21
        run: |
22
          # Fail if critical vulnerabilities found
23
          curl -H "Authorization: Bearer ${{ secrets.GOVERNANCEAI_API_KEY }}" \
24
            https://api.governanceai.com/v1/ai-bom/results/latest \
25
            | jq -e '.critical_vulnerabilities | length == 0'

Best Practices

✅ Do:

• Scan regularly (weekly minimum)
• Review dependencies quarterly
• Update vulnerable packages promptly
• Track data flows for sensitive data
• Export reports for compliance audits
• Set up webhooks for critical alerts

❌ Don’t:

• Hardcode API keys (use environment variables)
• Ignore vulnerability warnings
• Deploy models with unpatched vulnerabilities
• Share raw AI BOM data containing credentials
• Forget to update dependencies

Next Steps

• Running Scans - Scan your repositories
• Compliance Frameworks - Map to compliance standards
• API Reference - AI BOM API endpoints