Mappings
These mappings are informational only and do not constitute legal advice. Consult qualified counsel for compliance decisions.
SBOM (CycloneDX / SPDX)
| AgentBOM concept | External obligation / field | Notes |
|---|---|---|
| metadata.agent | CycloneDX component / SPDX Package | Agent identity complements software component identity; AgentBOM describes AI composition, not binary artifacts. |
| models[] | CycloneDX component (type: machine-learning-model) | Model weights and provider map to SBOM component entries where supported. |
| tools[] | CycloneDX dependency / externalReference | Tool and MCP server dependencies can be cross-referenced in SBOM dependency graphs. |
| provenance | SLSA / in-toto provenance | Build and source provenance fields align with supply-chain attestation formats. |
EU AI Act
| AgentBOM concept | External obligation / field | Notes |
|---|---|---|
| metadata.agent.description | Annex IV — system description | Supports technical documentation for high-risk AI systems. TODO(confirm): legal framing with counsel. |
| models[] | Annex IV — training/validation data (where applicable) | Model provider, version, and hosting support transparency obligations. |
| dataAccess[] | Data governance documentation | Classification and residency fields document data handling. |
| permissions | Human oversight measures | Autonomy level and human-in-loop flags support oversight documentation. |
RBI FREE-AI
| AgentBOM concept | External obligation / field | Notes |
|---|---|---|
| models[] | Model risk management | Provider, hosting, and digest support model inventory. TODO(confirm): mapping rows with Sid. |
| provenance + signatures | Audit trail / accountability | Signed, versioned documents provide tamper-evident audit artifacts. |
| dataAccess.classification | Data handling controls | Sensitivity classification supports explainability and data governance documentation. |