”What AI Is Inside the Software You Are Selling Me?”
Buyers and regulators are asking this question earlier every year. Today, Earnie’s answer is the same standing record it keeps for open source and cryptography: deterministic findings, versioned SBOMs, and an audit log that’s never edited or deleted, evidence for the questions your regulator or your buyer will actually ask about the code itself.A dedicated AI-BOM is not yet available. Detecting embedded AI SDKs, model files, and AI API keys, and exporting an AI-BOM mapped to frameworks like the EU AI Act, NIST AI RMF, or ISO/IEC 42001, is on the roadmap but isn’t part of the shipped product today. This page will be updated once that capability ships.