AI-BOM minimum elements proposal builds on SBOM lessons

The article warns that AI-embedded software expands supply-chain risk and describes recent incidents — malicious PyPI releases, a deceptive Hugging Face model downloaded ~244,000 times, and research demonstrating model-embedded malicious code — to argue for standardized AI bills of materials (AI‑BOMs). It summarizes IST’s proposal for minimum AI‑BOM elements, stresses the need for coordinated policy and technical standards to avoid fragmentation, and urges organizations to begin documenting AI model provenance and known unknowns now.