// GLOSSARY

Component List (BOM / AI-ML-BOM)

A verifiable component list for model artefacts, data sources, dependencies and build outputs. Called SBOM (Software Bill of Materials) for traditional software and AI-ML-BOM in the AI context; CycloneDX and SPDX are its structured, machine-readable record forms. Its necessity arises from the fact that most modern systems are assembled from inherited components: the source of a risk is often not in the code an organization wrote but in the library it inherited, the pre-trained model or the dataset. It is therefore not an inventory table but an evidence object; it answers not 'what is inside' but 'when a vulnerability is disclosed, am I affected, and to whom can I defend this'. As it matures it combines with provenance and attestation to form the inventory leg of supply-chain trust.