Short answer. An AI Bill of Materials (AIBOM) is a structured inventory of every component inside an AI system: the models, training datasets, software libraries, and the infrastructure it runs on. It extends the software bill of materials (SBOM) to the parts that make AI behave the way it does. From 2 August 2026, the EU AI Act requires this level of technical documentation for high-risk systems under Article 11, and across regulated industries an AIBOM is becoming a standard procurement requirement.
An AIBOM answers a question most organizations cannot answer today: what is actually inside the AI you are running? A model in production is never one file. It is a chain of dependencies, and an AIBOM writes that chain down.
In 2025, 94% of the AI projects Ableneo shipped used large language models. Every one of those models carries a chain of dependencies. Without an inventory, that chain is invisible, and invisible dependencies are where security, licensing, and compliance risk hide.
For banks and insurers in Central Europe, the AIBOM is no longer optional paperwork. Article 11 of the EU AI Act requires providers of high-risk AI systems to draw up technical documentation before the system reaches the market, and to keep it current. Annex IV lists nine mandatory sections, including a description of the system’s data, its development process, and its performance metrics. Those obligations apply from 2 August 2026. An AIBOM is the practical artifact that makes this documentation auditable rather than aspirational.
DORA adds a second driver. Financial entities must maintain a register of ICT third-party providers and manage supply-chain risk across their critical systems. An AI model served by an external provider is exactly such a dependency. The AIBOM connects the two regimes: it satisfies the EU AI Act documentation duty and feeds the DORA third-party register with the model and data suppliers behind each AI system. For a CIO at a Slovak, Czech, or Austrian bank, one inventory answers two regulators.
The cost of the gap is concrete. Breaching the EU AI Act obligations for high-risk systems, which include the Article 11 documentation duty, carries fines of up to EUR 15 million or 3% of global annual turnover, whichever is higher. Beyond the fine, a bank that cannot produce documentation on demand cannot prove that a credit-scoring or fraud-detection model behaves as claimed, which stalls the model in review instead of running in production. The AIBOM is the record that keeps the system both compliant and shippable.
An AIBOM is a full inventory of an AI system’s models, data, software, and infrastructure, extending the SBOM to the parts that shape AI behavior.
An AIBOM records four layers. Models: the base model, its version, and any fine-tuned variants. Data: training datasets, their sources, licenses, and any synthetic or third-party data. Software: the frameworks, libraries, and their exact versions. Infrastructure: the compute, hosting region, and serving configuration. Strong AIBOMs also capture performance metrics, known limitations, and bias considerations, so a reader can judge fitness for a specific use, not just read a parts list. The more regulated the use case, the more the data and licensing layers matter, because that is where audit questions land.
Two fields separate a useful AIBOM from a checkbox one. Provenance records where each dataset and model came from and under which license, which answers copyright and data-rights questions before a regulator asks them. Version records the exact state of every component, so when a model is retrained or a library is updated, the AIBOM shows what changed and when. A retrained model is a new system for audit purposes, and the AIBOM is what proves it.
A software bill of materials tracks code dependencies: libraries, packages, and their versions. It was built for deterministic software, where the same input gives the same output. AI systems break that assumption. A model’s behavior depends on data it trained on, weights that shift with retraining, and prompts that shape output at runtime. An SBOM captures none of that. The AIBOM keeps the SBOM discipline and adds the datasets, model weights, and training provenance that determine how an AI system actually behaves. In practice, an AIBOM contains an SBOM and extends it.
Two formats reached production maturity. CycloneDX, maintained by OWASP, added machine-learning support in version 1.5, and its ML-BOM captures models, datasets, training and inference configuration, and performance and safety notes. It fits automated CI/CD pipelines. SPDX 3.0, from the Linux Foundation and released in April 2024, added an AI Profile and a Dataset Profile. SPDX is ISO-standardized, which gives it weight in regulator-facing filings. The NIST AI Risk Management Framework points teams toward this kind of documentation as part of its Map and Govern functions. A bank does not have to pick one format forever. It has to pick one, apply it consistently, and keep it current.
Start with an inventory of the AI systems already in production, then document the highest-risk one end to end. Pick a system that touches customers or credit decisions, because that is where the EU AI Act high-risk rules bite hardest. Record its models, data, libraries, and hosting in a single AIBOM using one standard format. Assign an owner, and set a rule that no model reaches production without an AIBOM entry. This turns documentation from a year-end scramble into a control that runs continuously. Three systems documented well beat thirty documented never.
Ableneo has shipped 34 production AI projects across banking, insurance, and other regulated sectors in Slovakia, the Czech Republic, and Austria, and 4 of every 5 reach production. That track record depends on knowing exactly what sits inside each system, which is what an AIBOM formalizes. We build the documentation and governance layer alongside the model, not after it, so the audit trail exists on day one. Our work on model risk management for AI shows how an inventory like this fits into a wider control framework for regulated AI. The AIBOM is where accountability starts, because you cannot govern what you have not listed.
Key takeaways
Planning AI in a regulated business? Ableneo takes systems from classification to governed production.