Skip to main content

AI BOM

AI BOM (AI Bill of Materials) is an analysis that organizes a model's configuration into a bill of materials. It gathers information such as the model card, license, base model, training datasets, and file formats, and marks the places that need checking. It does not judge license violations or certify regulatory compliance. Used in the AI model service.

  • Analysis : Organizes a model configuration specification and outputs it in standard formats (CycloneDX · SPDX)
  • What you need : A connected model repository (Hugging Face · GitHub · GitLab)
  • Results : A component list, license categories, items needing verification, and standard-format documents

The analysis method splits into two depending on the connected repository type.

  • Hugging Face model : Reads the public model information to organize its configuration.
  • GitHub · GitLab repository model : Publishes a self-authored model specification written by the producing organization.

Hugging Face model​

For a Hugging Face model, the public model card · configuration · file information in the repository is read to organize components, licenses, and training data.

  • Run analysis : Start from Run analysis on the top summary toolbar. In the run window, you can edit or add to the declared info entered by the author and select the signal basis (how you use the model).
  • Model weights are not downloaded. Only the information published in the repository is read.
  • If the registered revision differs from the repository's current state, a notice appears that the current main is being analyzed.

The results screen consists of the following.

  • Component list : Provides the component count, a license-category filter, a card per component, and a detail drawer.
  • AI BOM document : Summarizes the overall review signal, component-list completeness, author input, deployed-file reconciliation (match · differs from record · target undetermined · not in record), and standard-format validation (CycloneDX · SPDX). The document is divided into five sections (model identification, usage terms · file inspection, provenance · unverified, items to check, validation · download), and you can download CycloneDX · SPDX artifacts.

GitHub · GitLab self-authored model specification​

For a GitHub · GitLab repository model, a self-authored model specification written by the producing organization is built and published instead of public model information.

  • Generate AI BOM : Click Generate AI BOM to generate (publish). It automatically collects the commit, model-file list and fingerprints, and presence of configuration files from the repository to build a CycloneDX 1.7 document.
  • Declared info (optional) : Enter the model name · version and information you know directly. Items you do not enter are shown as unrecorded.
  • The analysis target is fixed to the registered branch.

The scope read and how it is handled are as follows.

  • It reads the commit, the model-file list and fingerprints, README · config.json · LICENSE, and the model-file structure.
  • Model files are not executed. For safetensors only the header is read, and for PyTorch files (.pt · .pth · .bin · .ckpt) only the structural part, with a per-file byte limit applied.

The publication includes the model and base model, training · evaluation datasets (author declaration), model files and fingerprints (repository fingerprints reconciled against submitted fingerprints), evidence links (repository · branch · commit · configuration files), and the scope not recorded or not verified. When it passes CycloneDX 1.7 format validation, you can download the document.

The author declaration is recorded as-is

Declared info for a self-authored model specification is recorded as an author declaration, and Vulinder does not verify whether the entered content is true. Items read and reconciled from the repository and items that remain only as declarations are shown distinctly on screen.

What the output is​

AI BOM is a specification built by reading the repository's current public state. It is not a bill of materials for an entire running AI system, and it does not look up packages · search databases · external AI APIs. It is not a license-violation judgment or regulatory-compliance certification either.

Credits are deducted per run

AI BOM analysis and generation deduct credits (VU) each time they run. You can check usage and balance under Billing · subscription.