A software bill of materials lists the parts a piece of software is built from: each open-source library, its version, its supplier and how it relates to the others. Standard formats such as SPDX and CycloneDX make the list machine-readable, so it can be compared against vulnerability databases automatically.
SBOMs became a board-level topic after the Log4j flaw in December 2021, when many organisations spent weeks working out which of their systems used the affected library. An organisation with current SBOMs could answer that question in minutes. Regulators and large buyers now increasingly expect suppliers to provide one.
An SBOM tells you what is inside a system. It does not tell you whether a component behaves as intended, which is why it covers code well and AI models poorly. For models, the same idea is extended into an AI bill of materials that also records training data, adapters, retrieval sources and tools.