How to meet it
OWASP AISVS v1.01
Supply Chain Security for Models · AI BOM & Supply Chain Monitoring
Publish an AI bill of materials
Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin statements.
OWASP AISVS v1.01, requirement 6.2.1
In plain English
Publish a machine-readable bill of materials for every model, listing its datasets, weights, licences and where the data came from.
What good looks like
- Each model version has an AI bill of materials in a standard format.
- It is stored in version control with the model.
- It is updated whenever a component changes.
How teams usually do it
- CycloneDX or SPDX AI and dataset profiles, generated in the training pipeline.
Evidence an auditor would accept
- AI BOM files for deployed models.
Common mistakes
- Writing the bill of materials by hand once, so it drifts from reality.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.