Analyzes, from primary sources, the AI SBOM Compliance Management Guide written by the AI Work Group of the OpenChain Project under the Linux Foundation. Covers the structure, requirements, regulatory trends, significance, and limitations of the document, which extends the ISO/IEC 5230 methodology to the AI supply chain to define the minimum requirements a compliance program must meet.
Explains how to establish and communicate a written policy that governs AI SBOM compliance.
Explains how to establish a governance framework spanning the full AI system lifecycle and review it periodically to reflect emerging AI regulation.
Explains the procedure for reviewing the licenses of an AI system’s code, weights, datasets, and model tree to determine obligations, restrictions, and rights.
Explains how to publicly identify a means for third parties to make AI SBOM compliance inquiries and the internal procedure for responding to them.
Explains how to use the OWASP tool that generates a CycloneDX-format AI SBOM from a Hugging Face model and scores its completeness, together with actual execution screens.
The stage of establishing the foundation of an AI SBOM compliance program. Covers policy, competency, awareness, and scope.
Explains how to define the roles and responsibilities of an AI SBOM compliance program and identify and assess the competence required for each role.
Explains the procedure for reviewing transparency obligations imposed by regulation and applying risk mitigation measures to issues such as disclosure of training data.
Explains how to assign responsibility, staffing, funding, and legal expertise to an AI SBOM compliance program, and how to remediate non-conformances.
The stage of building AI-specific license, transparency, and SBOM processes that extend beyond code to cover models, weights, and datasets.
Explains how to use the AI BOM mode of OWASP cdxgen, which generates a CycloneDX SBOM from projects and models, together with actual execution output.
Explains how to ensure that program participants are aware of the AI SBOM policy and objectives, their own contribution, and the implications of non-conformance.
Explains the procedure and formats for generating and managing an AI SBOM, automation tools, and the verification areas that tools alone struggle to fill.
Introduces the key features and usage of security scanners that analyze AI model binaries, inference servers, and AI packages.
The stage of establishing a channel to respond to external compliance inquiries and assigning responsibility and resources to the program.
Explains how to clearly declare the scope and limits to which the AI SBOM compliance program applies.
The stage of establishing a governance framework across the full AI system lifecycle and reflecting emerging AI regulations.
An enterprise practice guide that explains the requirements of the OpenChain AI SBOM Compliance Guide (Version 1.0) clause by clause.
Introduces the key features and usage of open source tools that generate and analyze AI SBOMs, with actual execution screens.