The AI bill of materials is the next SBOM

What it says#

Three articles from one issue of a Chinese security journal were read together ¹. They are a sector piece, 专题·原创 | 油气行业人工智能供应链安全治理体系初探; a threat piece, 专题·原创 | AI中转站：AI供应链的新型控制点风险与治理路径; and a policy piece, 论坛·原创 | 我国支柱产业开源供应链安全风险与治理.

The sector piece splits the chain into four: model, data, tooling and compute. The old method assumes deterministic objects, so it misses adapters, poisoning after go-live, and what provenance cannot settle. Its answer is an AI bill of materials, a condition of go-live bound to an agent register.

The threat piece narrows to the intermediary between an agent and the upstream models. It sees the request context, the tool list, the arguments and the answer, and can alter them. Two conditions make it a control point: that capability, and untested default trust. Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain calls these routers plaintext proxies, with no cryptographic integrity enforced to the upstream model ².

The policy piece is about open source, and its claim is transmission down the dependency network at scale. It puts transitive depth at more than ten layers. GB/T 43848-2024 is an evaluation method for open source code security in software products, in force since 1 November 2024 ³. The article reads GB/T 43848-2024 as scoring four dimensions the record does not print: source trustworthiness, security quality, intellectual-property compliance and management discipline.

What we take from it#

The AI bill of materials is not a new document. It is the columns the software bill of materials never had, plus a register this library already publishes. The AI system register carries what runs and its impact assessment; the vulnerability handling record carries an SBOM index, one row per product version. What is missing between them is six fields: base model and version, provenance of the weights, dataset identity and hash, adapters applied, prompt templates, and the training configuration.

That framing decides the cost. Point (1) of Annex I Part II asks for vulnerabilities and components to be documented, and a bill of materials drawn up. It must be machine-readable and reach at least the first level of dependencies ⁴. Teams reach for SPDX or CycloneDX; the Regulation names no format, and the Commission may set format and elements by implementing act ⁵. Adding model columns to a record already produced on every release build is a schema change; a parallel AI inventory is a programme, out of date first.

The test the threat piece implies belongs in supplier tiering, not a new AI policy. Three questions: what does this component see, what can it rewrite, and is either capability checked by something the component does not control? A component answering "everything", "anything" and "no" is a control point whatever its contract value says. Across 28 paid routers and 400 free ones, nine injected malicious code and seventeen touched researcher-owned bait credentials, while deliberately weak decoys drew two billion billed tokens ².

Four actions.

1. Extend the record you already generate. Add the six model fields to the bill-of-materials schema, on the same release build.
2. Register agents, not only systems. An agent row states identity, capability, dependent components, permission scope and the accountable role.
3. Score intermediaries on the control-point test. Make the three questions a factor in third-party tiering, so a low-fee routing service can land in the top tier.
4. Set one hard target for the year: coverage. The share of production systems with a current record, not a maturity level.

Where we would push back#

All three pieces assume the record can be filled. None says what to write in the dataset hash column when the base model's publisher discloses none, the ordinary case for a hosted model. The honest answer is a stated gap in the register, not a blank cell.

The sector piece treats the four chains as equal. They are not. Compute rarely changes behaviour silently; a model version and a prompt template do it constantly.

The threat piece is the sharpest of the three, and its remedy the weakest. Five defensive dimensions applied to every intermediary is a control catalogue without a decision rule, which is how AI controls become shelfware. Tiering supplies the rule, and the lesson from open-source risk holds: the list earning the deep review is short if it is honest.

Related on GRCIDE#

• Vulnerability handling and the SBOM under the CRA, the record the model columns extend.
• AI system register, where an agent register belongs.
• Third-party risk across the contract lifecycle, on tiering first.
• Open-source risk is a maintainer problem, not a CVE count, the companion note.