Publications
Publications on AI Bill of Materials (AI BOM), AI transparency, and related SPDX and SBOM standards.
Key publications
In addition to the SPDX AI and Dataset profiles, the Working Group releases publications covering usage guidance and design rationale.
-
Explores the concept of AI BOM and how to use AI and Dataset profiles in SPDX 3.0 to document AI systems and datasets.
Karen Bennet, Gopi Krishnan Rajbahadur, Arthit Suriyawongkul, and Kate Stewart, “Implementing AI Bill of Materials (AI BOM) with SPDX 3.0: A Comprehensive Guide to Creating AI and Dataset Bill of Materials”, The Linux Foundation, October 2024. https://doi.org/10.70828/RNED4427.
-
Documenting the experiences, design decisions, and lessons learned from developing the AI and Dataset profiles in SPDX 3.0 in an open community setting.
Gopi Krishnan Rajbahadur, Keheliya Gallaba, Elyas Rashno, Arthit Suriyawongkul, Karen Bennet, Kate Stewart, and Ahmed E. Hassan, “Building an Open AIBOM Standard in the Wild”. Preprint, arXiv, October 2025. https://doi.org/10.48550/arXiv.2510.07070.
Accepted for the Software Engineering in Practice (SEIP) track of IEEE/ACM International Conference on Software Engineering 2026.
Presentations
Presentations and talks on SPDX AI and Dataset profiles and other works from the SPDX AI Working Group:
-
Software bill of materials for AI software by Gopi Krishnan Rajbahadur and King Gao at Open Source Summit Europe 2023, 18 September 2023.
The idea behind SPDX 3.0 AI and Dataset profiles. Why model cards and datasheets are not enough?
-
How to make SPDX industry standard for AI/ML by Cheuk Ting Ho at FOSDEM 2024, 4 February 2024.
Although this talk predates the SPDX 3.0 final release, it provides insights into the motivations for the SPDX AI BOM and the roadmap for community adoption.
-
Accountability taxonomy for AI software bill of materials by Arthit Suriyawongkul at Open Source Summit North America 2024, 16 April 2024.
Provides an overview mapping of EU AI Act informational requirements (focused on the market-entry obligations) to SPDX 3.0 data model.
-
SPDX 3.0 now supports SBOMs for AI applications. Interview with Kate Stewart, TFIR podcast, 9 May 2024.
“The challenge we were seeing with the supply chain is that it isn't just software and hardware anymore, it's now realistically data.”
-
From complexity to clarity: Addressing challenges in AI BOMs for compliance by Gopi Krishnan Rajbahadur and Kate Stewart at Open Source Summit Japan 2024, 29 October 2024.
Best practices and strategies to improve AI BOM accuracy and utility, equipping professionals with the insights to ensure their AI applications are compliant and prepared for future regulations.
-
SPDX: Tackling system risk in modern supply chains by Kate Stewart and Gary O'Neall at PyTorch Conference 2025, 22 October 2025.
Go through the key aspects in SPDX 3.0 that enable AI systems and the data used to train the systems to be made transparent, so proper system level risk analysis for licensing, security, and data biases in model training can be performed.
-
Trust, track, and verify: Securing AI pipelines end-to-end by Adolfo Garcia & Jun (Victor) Lu at Open Source SecurityCon 2025, 10 November 2025.
Explores how to secure AI pipelines using bill of materials, such as SPDX, to capture complete lineage of code, data, and models; AI-specific controls from CoSAI’s supply chain framework; and Unified AI-Ops practices across MLOps, DataOps, SecOps, and AgentOps.
-
PSF adopts SPDX for Software Bill of Materials, will you? by Arthit Suriyawongkul at PyCon Ireland 2025, 15 November 2025.
A lightning talk that quickly go through what is SBOM, how Python Software Foundation uses it, relevant PEPs, the minimum elements, the AI SBOM, and Python tools for SPDX.
See more SPDX presentations at SPDX Outreach resources.
Citations
When citing the SPDX AI Working Group or related standards, please reference:
- The official SPDX specification documents
- Working group publications and whitepapers
- Community repositories and resources
Stay updated
For the latest publications and research:
- Watch the SPDX GitHub organization
- Follow Linux Foundation Research
- Join SPDX mailing lists and community channels
Similar and related efforts
The SPDX AI Working Group is not the only technical group working on AI BOM. There is a growing number of communities in this space, including:
- CycloneDX, an SBOM standard from OWASP Foundation, also has AI BOM "capabilities" called Machine Learning Bill of Materials (ML-BOM).
- Croissant. Standardize how ML datasets are described to make them easily discoverable and usable across tools and platforms. A project from MLCommons.
- SBOM for AI Use-Cases Use cases and recommendations to operationalize SBOMs for AI systems, developed by the CISA-facilitated SBOM for AI Tiger Team. The latest version of the document (0.3 draft, 23 June 2025) can be found on its GitHub repository.
- OpenChain AI Study Group. Part of the OpenChain Project, also under the Linux Foundation. The group published Artificial Intelligence System Bill of Materials: Compliance Management Guide for the Supply Chain in October 2025. Join its mailing list at https://lists.openchainproject.org/g/ai
- OWASP AI BOM Project. A new initiative from the OWASP Foundation targeting first release in November 2025.
- TAIBOM. The Trustable AI Bill of Materials project addresses versioning and annotations for AI systems.
- OpenSSF AI/ML Security WG. Part of the Open Source Security Foundation.
- TechOps. Not exactly BOM, but another AI system technical documentation approach for the EU AI Act compliance.
- Coalition for Secure AI (CoSAI). A project from OASIS Open focused on AI security controls and mitigations.
- Responsible AI Licenses. A project focused on standardizing licenses for AI models and datasets.
- G7 Cybersecurity Working Group. The group has the work stream “Smarter Together: Artificial Intelligence” that published A shared G7 Vision on Software Bill of Materials for Artificial Intelligence on 12 June 2025. The paper discussed the properties and minimum elements, as well as the next steps within the G7 workstream towards a practical implementation.
For resources about SBOM in general, the SBOM-Everywhere Wiki the OpenSSF SBOM Everywhere SIG provides SBOM catalog and guidances on SBOM types, naming, and compliance.