1. Clause Overview

Program scope determines how far compliance extends. If the scope is ambiguous, it becomes unclear which AI systems need an SBOM and which models’ licenses need review. Scope must be declared first so that every subsequent clause knows what it applies to.

3.4 requires declaring the scope of application for each program. Scope can differ by organization. Some organizations cover a single product line; others cover an entire department or the whole organization. In AI, scope determination covers not only self-developed models but also externally sourced models and datasets, and the external release of in-house models.

2. Required Activities

• Define what the program applies to (externally deployed AI systems, externally sourced models and datasets, external release of in-house models, and so on).
• Record what is excluded from application and the rationale for the exclusion.
• Keep the scope statement consistent with the scope of application in the policy document.
• Review and update the scope periodically as the business environment changes.

3. Requirements and Verification Material

4. Compliance Methods and Samples by Verification Material

3.4.1 Program scope statement

Compliance Method

State the program’s scope and limits in writing. Clearly note what is included, what is excluded, and if excluded, on what grounds. An AI SBOM program becomes clearer when it declares what it applies to by breaking it down into material types and activities. The table below is an example of organizing scope.

Table 1. Example of an AI SBOM program scope declaration

Considerations

• Consistency with policy: The scope statement should not conflict with the scope of application in3.1 Policy.
• Grounds for exclusion: Record the rationale for excluded items. Even an internal experimental model falls into scope once it moves to external deployment, so put a review procedure in place for that transition point.([Recommendation of this guide])
• Periodic review: Update the scope whenever a new product line or new AI service is introduced.

Sample (Scope Statement)

## AI SBOM Compliance Program Scope
### Applies To
This program applies to all AI systems, models, and services that the company deploys
externally, and to pretrained models and datasets sourced externally. It also covers
activities that release in-house models externally.
### Excluded
Models used solely for internal experimentation or research and not deployed externally
are excluded. However, if such a model transitions to external deployment, it is brought
into scope through the intake review procedure.
### Review Cycle
Scope is reviewed and updated at least once a year, or as the business environment
changes.

5. See Also

• Scope of application in the policy:3.1 Policy
• AI SBOM for material within scope:3.9 AI SBOM
• ISO/IEC 5230 scope example:ISO/IEC 5230 Compliance Guide — 3.1.4 Program Scope