Rootconf 2026 Annual Conference

As organizations increasingly build, deploy, and consume AI systems, the need to understand what goes into these systems is becoming more important. AI Bills of Materials (AIBOMs) are emerging as a way to document this information, but the industry is still figuring out what an AIBOM should contain, how its components should be classified, and how this information can be collected and maintained.

Different standards, frameworks, and regulatory guidelines approach the problem differently. SPDX, CycloneDX, OWASP initiatives, and emerging regulatory expectations provide useful starting points, but several practical questions remain unanswered.

Should an AIBOM cover just the model, or the complete system around it? Where do datasets, model weights, fine-tuning, inference engines, prompts, RAG pipelines, external APIs, and agent tools fit? How much of this information can realistically be discovered, particularly when using third-party models or hosted AI services?

This Birds of a Feather (BoF) session aims to bring together platform engineers, developers, security practitioners, and AI/ML engineers to discuss these challenges.

Rather than presenting another proposed standard, we will examine existing approaches, identify areas of agreement and disagreement, and explore what a useful, maintainable AIBOM might look like in practice.

The goal is to leave with a clearer understanding of the unresolved questions, practical implementation challenges, and possible areas where the community can contribute.