AI SBOM Compliance Guide

Sun, 09 Aug 2026 17:03:59 +0900

This guide explains, one by one, each requirement ofAI System Bill of Materials — Compliance Management Guide for the Supply Chain (Version 1.0), published by the OpenChain AI Work Group. It walks through what verification material each clause requires, how to comply with it, and what samples and tools are ready to use.

This specification carries the same structure as ISO/IEC 5230, the open source license compliance standard — requirements, verification material, and rationale — over into the AI supply chain. It brings into scope not only code but also the licensing and transparency obligations of model weights, training datasets, and the Model Tree.

Author : OpenChain Korea Work Group /CC BY 4.0

Note

All 10 requirements (3.1–3.10) per the specification body have been written. The compare page that positions the standards relative to each other is still being expanded.

Intended Audience

Compliance staff at organizations that develop AI systems or exchange them through the supply chain
Practitioners who have an open source compliance (ISO/IEC 5230) program in place and want to extend it into AI
Legal, security, and development staff who need to check the licensing and transparency obligations of AI models and datasets

How to Use This Guide

Division of Roles Between the OpenChain Specification and the KWG Practice Guide

The OpenChain specification defines “what must be demonstrated.” This guide fills in “how to achieve it.” Each clause page does more than restate the specification’s requirements — it walks through the actual procedures, samples, tools, and how to handle the parts that tools alone cannot fill.

Notation — [Specification Requirement] vs [Guide Recommendation]

The content of each clause page falls into two categories.

[Specification Requirement] — Items the AI SBOM Compliance Guide body specifies withshall or as verification material.
[Guide Recommendation] — Items not found in the specification body but recommended by the OpenChain Korea Work Group based on practical experience, best practices, and other standards (ISO/IEC 5230, 42001, etc.). Adoption is at the organization’s discretion.

Activities presented alongside a verification material number (e.g.,3.1.1) are[Specification Requirement]. Enhancements this guide adds, such as automation, tool use, and intake gates, are[Guide Recommendation].

Note on Clause Numbering

The original specification’s table of contents and body section numbers are out of sync (the “3.9 AI content review and approval” section listed in the table of contents does not appear in the body, shifting all subsequent numbers down by one). This discrepancy has been reported to the OpenChain AI Work Group. This guide follows thebody’s section numbers (3.1–3.10).

Phased Implementation Roadmap

The 10 requirements are divided into four phases by implementation priority. Phase 1 establishes the program’s foundation, Phase 2 builds AI-specific compliance processes, Phase 3 puts operational structures in place, and Phase 4 establishes governance.

Phase 1 — Program Foundation

Goal: Define the program’s scope, establish policy, and secure competence and awareness.

Done	Verification Material	Description	Detailed Guide
☐	3.4.1	Program scope statement	3.4 →
☐	3.1.1	Documented AI SBOM policy	3.1 →
☐	3.1.2	Policy awareness procedure	3.1 →
☐	3.2.1~3.2.3	Role list, competence definitions, competence assessment evidence	3.2 →
☐	3.3.1	Evidence of participant awareness assessment	3.3 →

Phase 2 — AI Extension Processes

Goal: Build AI-specific licensing, transparency, and SBOM processes that cover not just code but also models, weights, and datasets. This is the area where the AI SBOM Guide expands most on ISO/IEC 5230.

Done	Verification Material	Description	Detailed Guide
☐	3.5.1	License obligation review and documentation procedure	3.5 →
☐	3.6.1	Transparency obligation review procedure	3.6 →
☐	3.9.1	AI SBOM identification, tracking, review, approval, and archiving procedure	3.9 →
☐	3.9.2	Records demonstrating procedure compliance	3.9 →

Phase 3 — Operational Structure

Goal: Create a channel for responding to external compliance inquiries, and assign accountability and resources to the program.

Done	Verification Material	Description	Detailed Guide
☐	3.7.1~3.7.2	Public inquiry channel, internal response procedure	3.7 →
☐	3.8.1~3.8.5	Role assignment, resources, legal expertise, remediation procedure	3.8 →

Phase 4 — Governance

Goal: Put in place a governance framework spanning the full AI system lifecycle, and reflect emerging AI regulation.

Done	Verification Material	Description	Detailed Guide
☐	3.10.1	AI governance framework and periodic review procedure	3.10 →

Full Clause Checklist

The body of the AI SBOM Compliance Guide consists of10 clauses and 19 verification material items in total (by this guide’s verification material numbering).

Clause	Title	Verification Material	Detail
3.1	Policy	2 items	Go to →
3.2	Competence	3 items	Go to →
3.3	Awareness	1 item	Go to →
3.4	Program Scope	1 item	Go to →
3.5	License Obligations	1 item	Go to →
3.6	Transparency Obligations	1 item	Go to →
3.7	Access	2 items	Go to →
3.8	Effectively Resourced	5 items	Go to →
3.9	AI SBOM	2 items	Go to →
3.10	Governance	1 item	Go to →

Total: 10 clauses / 19 verification material items

Automation Maturity Map

This is an honest breakdown of how far each AI SBOM compliance task is automated by tools today. For “generation,” usable open source tools already exist. Interpreting license obligations and tracking compliance with non-standard licenses, on the other hand, remain the work of people and policy. Each clause page follows this line to distinguish “what a tool handles” from “what a person must fill in.”

Task	Automation Level	Representative Open Source Tool
Code/dependency SBOM generation	Mature	cdxgen, Syft
AI model/metadata BOM generation	Tools emerging	OWASP AIBOM Generator, cdxgen`aibom` mode
Static analysis of model binaries	Tools emerging	Lab700x AI SBOM Scanner
Identifying LLM inference servers and AI packages	Mature	Trivy, Syft
SBOM storage and vulnerability monitoring	Mature	Dependency-Track, SW360
Interpreting license obligations, tracking non-standard compliance	Immature (people/policy)	Tool support still developing

Generation by Tool, Interpretation by People

Several tools already generate AI SBOMs automatically. But whether the license fields in a generated BOM are accurate, whether the behavioral use restrictions of non-standard licenses (the RAIL family, the Llama Community License) are respected, and whether obligations propagate downstream without being dropped — a tool cannot automatically guarantee any of this. Policy and human review fill this gap. See3.5 License Obligations for details.

The installation and use of each tool is covered with execution screens and command output in theTools section.

Relationship to Other Standards

Relationship to ISO/IEC 5230 and 42001

ISO/IEC 5230 (License Compliance): The AI SBOM Guide inherits the 5230 methodology directly. Organizations that already have a 5230 program in place can reuse program foundations such as policy, competence, and resources, and only need to add the AI extension areas. See theISO/IEC 5230 Compliance Guide.
ISO/IEC 42001 (AI Management System): The technical details of AI SBOM formats (SPDX 3.0 AI Profile, CycloneDX ML-BOM) and generation tools are covered in theISO/IEC 42001 Guide — AI SBOM. Building on that, this guide focuses on “how to operate the compliance program.”

Original Specification

Document: Artificial Intelligence System Bill of Materials — Compliance Management Guide for the Supply Chain, Version 1.0
Published: OpenChain Project AI Work Group, 2025-10-20
License: Creative Commons Attribution 4.0 (CC-BY-4.0)
Authoritative copy: Published as PDF and markdown in the OpenChain Reference-Material repository (AI-SBOM-Compliance/en)
Announcement:openchainproject.org

]]>

Compliance | Haksung