This talk introduces the newly launched OpenChain AI SBOM Guide, a framework designed to build trust and establish standardized compliance processes within the AI ecosystem. The speaker emphasizes that trust in the supply chain is built on transparent and reliable documentation. The guide itself is a high-level process standard, outlining the necessary organizational structures for responsible AI development, such as having a formal AI policy, competent personnel, and clear license management for data sets. It mandates the creation of an AI Software Bill of Materials (AI SBOM) — a technical inventory of a model's components — distinguishing it from a model card, which describes performance. The presentation highlights the collaboration with the SPDX community, whose standards define the specific contents of an AI SBOM. The guide is positioned as a proactive, industry-led blueprint to help organizations prepare for emerging regulations like the EU's Cyber Resilience Act and to reduce friction between partners by creating a common, verifiable standard for AI governance.
Building Trust in AI: An Introduction to the OpenChain AI SBOM Guide
00:00:01 The Foundation of Trust: The presentation opens by arguing that trust between organizations is built on reliable and readily available documentation. An example is given where a new contractor immediately established trust by providing a system bill of materials (SBOM) within 30 minutes of the request.
01:53 The Role of OpenChain: OpenChain's vision is to build trust throughout the software supply chain by creating process standards. This alignment on best practices is designed to make the entire industry more efficient, cheaper, and faster.
02:50 Creating Industry Standards: OpenChain has developed two key ISO standards: one for open-source license compliance (ISO 5230) and another for security assurance. These are high-level process standards that have laid the groundwork for recent legislation, like the EU's Cyber Resilience Act, which now requires SBOMs.
05:48 Launch of the AI SBOM Guide: The talk announces the official launch of the OpenChain AI SBOM Guide, created by the AI Working Group. This guide aims to establish what good compliance looks like for AI systems. A key point is the warning about "quishing," a new threat of malicious QR codes generated by AI.
06:58 AI SBOM vs. Model Cards: The speaker clarifies the distinction between different forms of AI documentation. Model cards and data cards focus on transparency (what a model does and how it performs), whereas an AI SBOM is a technical inventory detailing how the model was built and what components it contains.
08:17 Core Principles of the Guide: The guide is a light-touch, six-page document outlining key processes an organization should have in place. These include having a formal AI policy, ensuring personnel are competent and trained, managing license obligations for data and models, and, most importantly, having a defined process for creating and managing an AI SBOM.
11:35 Collaboration with SPDX for Technical Details: While the OpenChain guide mandates the process of creating an AI SBOM, it relies on the SPDX 3.0 standard to define the specific technical content. Key fields to be captured in an AI SBOM include model type, training data, data provenance, energy usage, bias, and risk factors.
13:06 Call to Action for Developers: A key takeaway is the urgent call for developers and organizations to begin documenting their AI systems now. Capturing information about training data and licenses during development will be significantly easier than trying to find it later to meet regulatory or legal demands.
14:22 Reducing Industry Friction: Jimmy, the chair of OpenChain, adds that the guide serves as a blueprint for AI governance. Adherence allows companies to validate a supplier's processes, reducing friction and speeding up transactions by establishing a common language for trust.
16:25 The Regulatory Landscape: During the Q&A, it is noted that regulators are already beginning to require AI SBOMs. Examples include the EU Cyber Resilience Act (for products containing AI) and the FDA in the US for medical devices.
17:27 Internal and External Value: The guide is valuable even for companies developing AI for internal use only. It provides a best-practice framework for setting up internal governance and builds trust and clear communication between different internal teams.