AI-BOM
for Enterprise AI Governance

–  An AI BOM, or AI Bill of Materials, is an inventory of the AI components used in software. It can include models, agents, MCP servers, LLM SDKs, dependencies, origins, and related metadata needed for governance, risk management, and compliance.

An SBOM focuses on software components such as libraries and packages. An AI BOM extends that idea to AI – specific elements such as models, agents, MCP servers, prompts, and AI frameworks, along with the metadata needed to govern them responsibly.

AI adoption is moving faster than manual governance. Without a continuously updated AI BOM, organizations struggle to answer basic questions about what AI they use, where it lives, what it depends on, and whether it meets policy and compliance requirements.

Checkmarx AI – BOM Software helps teams produce standards – aligned inventory documentation and maintain traceability across AI assets, risks, and governance actions. That supports audit readiness and helps teams respond faster to requirements tied to the EU AI Act, NIST AI RMF, and ISO 42001.

Checkmarx uses deterministic discovery directly from code and configuration files rather than relying on inference alone. Checkmarx AI-BOM does not limit to LLMs but covers a wide range of AI components including LLMs, AI Libraries, AI SDKs, AI Orchestration frameworks, MCP Clients, MCP Servers, Agents, and more. It also runs natively in Checkmarx One, so teams can inventory AI components, enforce policy, and generate AI-BOM documentation in the same AppSec workflows they already trust.

Yes. Checkmarx AI – BOM is designed to fit existing pull request, CI/CD, and Checkmarx One workflows. Teams can surface AI component usage, detect policy violations, and act on findings without switching to a separate platform.