Vendors · AI bill of materials
Each AI vendor’s record downloads as a procurement file
Procurement teams now ask for an AI bill of materials in CycloneDX or SPDX. Each vendor below has both, made from the same record as its page and checked on 4 Nov 2026.
The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256.
Download a vendor’s files
127 values with a quote · 47 fields not stated · 0 fields withdrawnWhat each file holds
the same facts in two formats- CycloneDX 1.6
- One component of type machine-learning-model. Each value is a named property, with the vendor’s own words, the page it is quoted from, the sha256 of the kept copy and the day it was kept.
- SPDX 3.0.1, AI profile
- One AI package. Each value is an annotation on it that carries the same quote, page, sha256 and day.
- Standards
- Where a value bears on a control of the EU AI Act, DORA, ISO/IEC 42001 or the NIST AI RMF, the file names the control as “responsive to”. Neither file says that a vendor complies with any standard, and the SPDX compliance field is left out on purpose.
- Gaps
- A field that the vendor’s pages do not state is listed as withheld, with no value. A value the record withdrew is listed as withdrawn, with its day and reason, and its old words are not in the file.
- Stable bytes
- The serial number and the timestamp come from the facts and the day they were checked. The same record gives the same file, so two downloads can be compared line by line.
Sources
vendors.csv Every dataset → Status → Glossary →- CycloneDX 1.6 JSON reference, Ecma TC54.
- SPDX 3.0.1 specification, the Linux Foundation.