Implementing an AI BOM With SPDX 3.0: Insights From a Real AI4S Project
Talkat Open Source Summit Japan + AI_dev: Open Source GenAI & ML Summit + Automotive Linux Summit 2025 · 2025-12-08..12-10·
summary
Implemented an AI Bill of Materials using SPDX 3.0 inside the AI4S project that instruments every pipeline stage—crawl/download, synthetic generation, preparation, training, evaluation—to automatically emit SPDX entities, builds and relationships, producing a full lineage graph of datasets, intermediate artifacts, base and derived models, tools, scripts, configs and policy events. The system records agents, hashes and licenses, copes with the EU AI Act quirks like first 10% of URLs and gaps around token counts by token consumption recorded per build, and works but requires centralized pipelines and automation.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 2:33EU AI Act obligations
- 5:45AI supply chain challenges
- 7:29General purpose AI model
- 11:07SPDX 3.0 for AI BOM
- 12:33SPDX 3.0 classes for AI
- 15:46AI supply chain database
- 18:22AI supply chain workflow
- 21:17SPDX 3.0 vs EU AI Act gaps
- 24:07Automated AI production pipeline
- 25:53Demo: AI BOM with SPDX 3.0
- 27:21Conclusion
- 28:27Q&A
related talks
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
37mSBOM Implementation Reality: From Crawl to Walk - SPDX Lite Pro...
46mAdvancing Transparency and Security in Software: A Deep Dive Into SPDXv3
28mSPDX: Tackling System Risk in Modern Supply Chains
53mTooling Up for SPDX Software Package Data Exchange
24mLicense compliance with AI assisted coding
42mBoF: State of SBOM Tools
16mSPDXv3: Advancing Transparency in Software