---
title: "What is an ML-BOM?"
description: "An ML-BOM lists the models, datasets and dependencies inside your AI systems, so you can see what you run before an auditor asks."
url: "https://xygeni.io/sscs-glossary/what-is-ml-bom/"
updated: "2026-10-13"
category: Software Supply Chain Security
---

# What is an ML-BOM?

**An ML-BOM (machine learning bill of materials) is a machine-readable inventory of the models, datasets, frameworks and dependencies that make up an AI system, along with where each one came from.**

- **Why it exists:** a traditional SBOM lists code libraries. It does not describe a model, its training data or its provenance.
- **The formats:** CycloneDX ML-BOM (standardized as ECMA-424) and the SPDX 3.0 AI and Dataset profiles.
- **The guidance:** the G7 *SBOM for AI: Minimum Elements*, published May 2026, defines seven data clusters. It is voluntary.
- **The hard part:** not the format. It is finding every AI asset in the first place.

## The Definition: what Is an ML-BOM?

Ask most engineering teams which open-source libraries their application uses and they can answer in minutes, because their SBOM tells them. Ask which models, datasets and AI frameworks the same application depends on, and the answer usually starts with "let me check."

An ML-BOM closes that gap. It is the AI equivalent of a software bill of materials: a structured, machine-readable record of every machine learning component in a system. For each model it captures identity, version, supplier and licence, plus details an SBOM never needed, such as the datasets it was trained on, its intended use and its known limitations.

The term comes from [CycloneDX](https://cyclonedx.org/capabilities/mlbom/), which added ML-BOM support in version 1.5. You will also see **[AI-BOM](https://xygeni.io/sscs-glossary/what-is-an-ai-bom/)** and **SBOM for AI** used for the same idea, usually with a wider scope that includes agents, prompts and AI services, not only trained models.

## What an ML-BOM Contains

The exact fields depend on the format, but a useful ML-BOM answers five questions about each AI component:

1. **What is it?** Model name, version, type and architecture.
2. **Where did it come from?** Supplier, source repository or model hub, and licence.
3. **What was it trained on?** The datasets used, their origin and any known sensitivity.
4. **What does it depend on?** The frameworks, libraries and infrastructure it needs to run.
5. **What are its limits?** Intended use, known risks and performance characteristics.

The G7 guidance groups the same ideas into seven clusters: metadata, system-level properties, models, dataset properties, infrastructure, security properties and key performance indicators.

## ML-BOM vs SBOM

An ML-BOM does not replace an SBOM. AI systems are still software, so they still need one. The ML-BOM adds the layer an SBOM cannot see.

| Dimension | SBOM | ML-BOM |
| --- | --- | --- |
| Describes | Software components and libraries | Models, datasets and ML components |
| Key fields | Name, version, supplier, licence, hash | Plus training data, provenance, intended use, limitations |
| Main risk it tracks | Vulnerable or malicious dependencies | Untrusted models, poisoned or sensitive data, unknown provenance |
| Changes when | A dependency is updated | A model is retrained, swapped or fine-tuned |
| Formats | CycloneDX, SPDX | CycloneDX ML-BOM, SPDX 3.0 AI and Dataset profiles |

## Why ML-BOMs Matter Now

**AI is entering codebases without review.** Developers pull models from public hubs, add AI frameworks and connect MCP servers as easily as they add a library. Each one brings code, weights and data the organisation did not write and may not have vetted.

**The AI supply chain is an attack surface.** The [OWASP Top 10 for LLM Applications](https://genai.owasp.org/llmrisk/llm032025-supply-chain/) lists supply chain as risk LLM03: compromised models, poisoned data and malicious packages in the AI stack. You cannot assess a component you do not know is there.

**Buyers and auditors are starting to ask.** No regulation mandates an ML-BOM by name. But the EU AI Act expects technical documentation for high-risk AI systems, the Cyber Resilience Act requires an SBOM, and frameworks such as Spain's ENS require an asset inventory. An ML-BOM is the practical evidence behind all three, and procurement teams are adding it to their questionnaires.

## How to Build an ML-BOM

Writing one by hand works for a single model. It does not work for an organisation. A sustainable approach has three parts:

- **Connect it to risk.** An inventory nobody acts on is paperwork. Each component should link to its vulnerabilities, its licence and its provenance.
- **Discover automatically.** Scan code, declared dependencies and configuration files rather than relying on developers to report what they use.
- **Generate continuously.** Regenerate the ML-BOM whenever a model, dataset or dependency changes, the same way mature teams regenerate SBOMs in CI.

## Know What AI You Run Before Someone Asks

[Xygeni AI Security](https://xygeni.io/ai-security/) discovers the AI assets across your repositories (models, AI frameworks, datasets, inference endpoints, agents, MCP servers, skills, prompts, guardrails and the AI coding tools in use) from application code, declared dependencies and the configuration files AI tools leave behind. Nothing depends on developers declaring what they use.

From that inventory, Xygeni generates a machine-readable AI-BOM you can hand to auditors and customers. The AI stack's dependencies get the same treatment as the rest of your code: CVEs through software composition analysis, and malicious packages detected before a signature exists.

**Schedule a demo** to see the AI-BOM of your own codebase.

## FAQ

 ************************What is an ML-BOM in simple terms**********************?**

An ML-BOM is an ingredients list for AI. It records which models, datasets and frameworks a system uses and where each came from, so security, legal and compliance teams can assess the risk.

  ******************What is the difference between an ML-BOM and an AI-BOM?******************

Mostly. LLM red teaming focuses on language models and the applications built on them. AI red teaming is The terms overlap. ML-BOM is the CycloneDX name and focuses on machine learning models and datasets. AI-BOM is broader and often includes agents, prompts, MCP servers and AI services as well.

  ************Is an ML-BOM required by law**********?**

Not by name. It is the practical evidence for obligations that do exist, such as EU AI Act technical documentation for high-risk systems and the SBOM required by the Cyber Resilience Act. The G7 minimum elements for an SBOM for AI are voluntary.

  **********Which format should an ML-BOM use?**********

The two established formats are CycloneDX ML-BOM, standardized as ECMA-424, and the [SPDX 3.0](https://spdx.dev/) AI and Dataset profiles. Pick the one your existing SBOM tooling already supports, so software and AI inventories live together.