Supply Chain

Proposer(s)

Duncan Sparrell (propose, contribute, not lead)
sFractal Consulting
USA

Summary

The work in this theme would center around how the supply chain affects trust. For example, an AI Bill of Materials (AIBOM) is a structured, machine readable inventory of everything inside an AI system: the model itself, the datasets used to train and fine tune it, the software dependencies that serve it, and the provenance of each component. The is useful because it gives evidence—not merely assurances—about what an EAI device contains, where its models and data originated, what third-party services and software it depends on, and how those elements have changed. That transparency lets the people/systems assess inherited security, privacy, licensing, reliability, and governance risks before deployment; verify whether the controls and claims are credible; and rapidly determine exposure when a vulnerable model, compromised dataset, or unsafe update is discovered. AIBOM provides a living, auditable chain of custody for the AI supply chain, making trust a matter of traceable facts, contractual accountability, and ongoing risk management.

Scope / Open Questions

Scope should focus on the supply chain impact on trust.
Scope should be restricted to what is not already done or underway in SG17, and what is not in the other themes wrt defining trust.

Related Work

• AI Risk Management Framework | NIST https://www.nist.gov/itl/ai-risk-management-framework
• ITU‑T X.2105 Security threats targeting the software supply chain (06/2026)
• ITU‑T X.2106 Guidelines for software supply chain security audit

Related Themes

• 48

Discussion