Every AI Decision Comes with a Bill of Materials

SPDX 3.0 AI Profile — full component traceability from model to decision. Know exactly what went into every automated output.

What is an AI Bill of Materials?

A structured inventory of every component involved in an AI decision — from model provenance to runtime dependencies. Complete transparency, machine-readable, integrity-verified.

Component	What it captures
AI Models	Name, version, provider, training date, architecture type
Datasets	Source, size, preprocessing steps, bias assessments
Training Provenance	Hyperparameters, compute environment, validation metrics
Decision Context	Input evidence, policy applied, resolution timestamp
Dependencies	Library versions, framework, runtime environment
Integrity	SHA-256 hash of every component, tamper-evident chain

Three Levels of Transparency

From individual decisions to tenant-wide inventories — visibility at every scale.

Per-Decision BOM

Every resolve() call produces a BOM tracing exactly which model, data, and policy contributed to this specific output.

Per-System BOM

Aggregated view of all components used by an AI system across all its decisions. Updated automatically as components evolve.

Tenant-Wide BOM

Complete inventory of all AI components across all systems registered by a tenant. The regulator’s dashboard.

Standards Compliance

Built on the SPDX 3.0 AI Profile (ISO/IEC 5962) — the emerging standard for AI component transparency.

Export format	Purpose
SPDX JSON-LD	Machine-readable, standard-compliant
JSON Compact	API integration, programmatic consumption
Markdown	Human review, audit documentation

Each BOM is integrity-verified: SHA-256 hash computed at generation, verifiable at any time.

Why It Matters

EU AI Act Art. 15 requires accuracy, robustness, and cybersecurity documentation. Art. 11 requires technical documentation including training data provenance. The AI BOM satisfies both — automatically, for every decision.

API Integration

Retrieve the Bill of Materials for any decision via the REST API. Four endpoints, three formats.

GET /api/v1/decisions/{id}/ai-bom?format=spdx
GET /api/v1/decisions/{id}/ai-bom?format=json
GET /api/v1/decisions/{id}/ai-bom?format=markdown
POST /api/v1/tenants/{tenant_id}/ai-bom/verify

Audit-ready by default.

Every decision carries its component inventory. Every component is integrity-verified. Every export is standards-compliant.

Book a Pilot Call