Behind Every AI SBOM Lies a Minefield: Here's How to Not Step...
summary
OpenChain launches an AI SBOM guide launched (6 pages) that prescribes process controls (policy, roles, competency, artifact retention) and urges documenting model provenance now. Guide aligns with SPDX 3.0O AI/data profiles to capture model type, training data provenance, licenses, energy, explainability, bias, update mechanisms and risk. OpenChain AI work group (started 2023, meets ~twice monthly) builds on ISO 5230 and a security ISO; regulators already push SBOMs via the EU Cyber Resilience Act and the FDA for medical devices.
AI-written summary · about
chapters (12)
- 0:00Building trust in AI ecosystems
- 1:23Open Chain’s trust role
- 3:30ISO standards for compliance
- 5:54Introducing AI working group
- 7:41AISBOM guide overview
- 11:36SPDX AI profile transparency
- 13:21Summary and call to action
- 14:26Jimmy on Open Chain’s mission
- 16:37Regulatory requirements for AI SBOMs
- 17:46Internal AI compliance processes
- 20:58Sensitive data in AI docs
- 22:03Legal use of AI SBOMs
related talks
29mAIBOM: Powering Transparency and Security in AI and Software Supply Chains
49mHow to Benefit from SBOM in Metaverse Applications
37mFrom Complexity to Clarity: Addressing Challenges in AI BOMs for...
43mExtending SBOMs to Describe AI Systems
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
26mSBOM Open Questions
25mAI-Driven Supply Chain Security: Using AI-BOM to Detect Hidden Vulnerabilities
45mSmarter Than Your Average SBOM!