TL;DR: An SBOM inventories software components (name, version, supplier, package URL, hash, dependency relationships) in SPDX or CycloneDX so you can answer "are we affected?" when a vulnerability lands. An AI-BOM adds the components that shape AI behaviour: models and versions by hash, base-model lineage, fine-tunes and adapters, training and evaluation datasets with sources and licences, tokenizers, prompts, tools and MCP servers, evaluations and intended use. The key difference is lineage: behaviour is inherited from upstream models and data, so incident response depends on tracing descent, not just listing files.
How to approach it
Define the SBOM and its purpose first, then extend it component by component, explaining why each AI-specific item matters for a real use (incident response, licensing, governance). Finish with how you would keep it accurate, since stale inventories are the common failure.
A strong answer
- 1
1 · SBOM
Software components
- Name, version, supplier, purl, hash, dependencies
- SPDX or CycloneDX
- 2
2 · AI-BOM adds
Components that shape behaviour
- Models by hash, base model lineage
- Datasets, prompts, adapters, tools
- 3
3 · Use
Incident and licence questions
- Which products use this model or dataset?
SBOM essentials. Component identity (name, version, supplier, package URL or CPE), hashes, dependency relationships, plus who generated the SBOM and when. Formats: SPDX (ISO/IEC 5962:2021) and CycloneDX (ECMA-424). Generated at build time, attached to the artifact, ideally signed. VEX documents state which listed vulnerabilities actually affect the product.
What an AI-BOM adds.
| Component | Fields that matter | Why |
|---|---|---|
| Model | Name, version, hash, format, publisher, licence, intended use | Exact identification; licence compliance |
| Lineage | Base model, fine-tuning runs, adapters, merges | Trace inherited backdoors or flaws |
| Datasets | Source, snapshot or hash, collection date, licence, personal-data status | Poisoning response, privacy and copyright obligations |
| Tokenizer and config | Version, source | Can change behaviour or carry code |
| Prompts and system instructions | Version, owner | Behaviour changes without code changes |
| Tools and MCP servers | Source, version, permissions | Agent capability and supply chain |
| Evaluations | Suites run, results, date | Evidence for release decisions and audits |
| Serving stack | Inference servers and libraries | Ordinary CVEs |
Formats. CycloneDX added ML-BOM support in version 1.5 (2023); SPDX 3.0 (2024) added AI and Dataset profiles. Model cards and dataset documentation are the human-readable sources.
Keeping it accurate. Generate entries automatically from the model registry and training platform rather than by hand; require a registry entry (and therefore an AI-BOM entry) before deployment; reference artifacts by hash; and make it queryable ("which deployments descend from model X?").
Uses. Incident response when a public model or dataset is compromised; licence checks before commercial use; evidence for regulators and customers about training data and evaluations; and change tracking when behaviour shifts.
What interviewers probe next
- "An upstream dataset is found to contain copyrighted or personal data. How does the AI-BOM help?" Lineage identifies every model trained on it, so you can assess, retrain or restrict them.
- "Should prompts be in a BOM?" Yes, versioned, because they change behaviour as code does.
- "Who consumes the AI-BOM?" Security for incidents, legal for licences, governance for registers and regulators, and customers in procurement reviews.
What if?
What if · interview follow-ups
Hold your answer as the constraints change
An enterprise customer asks for a bill of materials for your AI product, which uses a fine-tuned open model, a retrieval index and several MCP servers.
Start here
What does an SBOM cover?
What question does an SBOM answer during an incident?
Software components: name, version, supplier, package URL, hash and dependency relationships, in formats such as SPDX or CycloneDX. Its main job is answering 'are we affected?' when a vulnerability in a component is announced.
Carry it forwardSBOMs inventory software components for impact analysis.
Weak answerThinking an SBOM covers models and data.
Constraint changes
What does an AI-BOM add?
What determines the product's behaviour besides code?
Components that shape AI behaviour: models and versions by hash, base-model lineage, fine-tunes and adapters, training and evaluation datasets with sources and licences, tokenizers, prompts, tools and MCP servers, evaluations and intended use.
Carry it forwardAI-BOMs add models, data, prompts, tools and evaluations.
Weak answerListing only the model name.
Constraint changes
Why does lineage matter so much?
What would you need if the base model were compromised?
Behaviour is inherited from upstream models and data. If a base model is found to have a backdoor or a dataset is found to be poisoned or unlicensed, you need to trace which fine-tunes and products descend from it. Listing files is not enough; descent is.
Carry it forwardAI-BOMs must record descent, not just contents.
Weak answerRecording the fine-tuned model without its base.
Constraint changes
What if the customer asks about training data you cannot disclose fully?
What does the customer need the information for?
Disclose categories, sources at an appropriate level, licences and provenance controls, and evaluation results, and explain what is withheld and why. The customer's goal is assessing risk and rights; give enough to support that.
Carry it forwardDisclose enough to support the customer's risk assessment.
Weak answerRefusing all data information or overpromising.
Constraint changes
How do you keep the AI-BOM current?
How often do prompts and tools change?
Generate it from the build and registry pipelines on every release, with versions and hashes, rather than maintaining a document by hand. Prompts, tools and MCP server versions change often and must be included.
Carry it forwardGenerate AI-BOMs from pipelines each release.
Weak answerWriting the AI-BOM once for the sales cycle.
Now defend it
What would you give the customer?
An SBOM in SPDX or CycloneDX for software components, plus an AI-BOM covering the base model and fine-tune by hash with lineage, adapters, datasets with sources and licences, tokenizer, prompts, the retrieval index's sources, MCP servers and tools with versions, evaluations and intended use, generated from the release pipeline and versioned.
How it's scored
Weak: "It's an SBOM for AI" with no specific fields.
Hire: Lists models, datasets, lineage and licences, and explains incident-response value.
Strong Hire: Covers prompts, tools, evaluations and serving stack, names formats with AI support, and explains automatic generation by hash with registry enforcement.
Common mistakes
- Identifying models by name only.
- Omitting fine-tunes and adapters, which breaks lineage.
- Hand-maintained spreadsheets that drift from reality.