Artificial Intelligence Bill of Materials (AI-BOM): Inventorying Models, Skills and Agents

IntermediateFree5 modules · 14 lessons · ~2 min

About this course

A compliance course on building and governing an AI bill of materials: the models, datasets, model artefacts, skills, agents, MCP servers, vector stores and SaaS AI an organization runs, expressed in CycloneDX ML-BOM and the SPDX AI profile. You will learn how Safeguard's AI-BOM discovery, model-artefact scanning, first-class skill and agent scanning and agent identity populate the register, how policies, gates and guardrails make it enforceable, how to publish, share and request AI-BOMs, and how continuous evidence mapping answers the EU AI Act, ISO/IEC 42001 and NIST AI RMF.

What you'll learn

Why an AI-BOM

From SBOM to AI-BOM: What Changes When the Component Is a Model
Standards: CycloneDX ML-BOM and the SPDX AI Profile
The AI Asset Taxonomy: Models, Datasets, Artefacts, Skills, Agents, MCP Servers, Vector Stores and SaaS AI

Discovery with Safeguard

Code Discovery: SDK Imports, Model References and Model Repository Pulls
Cloud and SaaS Discovery: Managed Model Services, Shadow AI and Vector Databases
Model Artefact Scanning: Pickle, PyTorch, safetensors, GGUF and ONNX

Skills, Agents and Identity

Skills and Agent Configurations as First-Class Inventory Objects
Agent Identity as Inventory: Which Agent Holds What Access, at What Level
MCP Servers in the Inventory and the Gold Registries

01Why an AI-BOM3 lessons

From SBOM to AI-BOM: What Changes When the Component Is a Model
Standards: CycloneDX ML-BOM and the SPDX AI Profile
The AI Asset Taxonomy: Models, Datasets, Artefacts, Skills, Agents, MCP Servers, Vector Stores and SaaS AI

02Discovery with Safeguard3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Governance and Reporting

Policies, Guardrails and Gates on AI Assets: From Inventory to Enforcement
Exporting, Publishing and Sharing the AI-BOM: Portal, Trust Center and TPRM
Compliance Evidence: EU AI Act, ISO/IEC 42001 and NIST AI RMF Through Continuous Mapping

Building the Program

Building the AI-BOM Program: Ownership, Cadence, Data Quality and Metrics
Worked Example: A Bank Inventories Its AI Estate

Code Discovery: SDK Imports, Model References and Model Repository Pulls

Cloud and SaaS Discovery: Managed Model Services, Shadow AI and Vector Databases

Model Artefact Scanning: Pickle, PyTorch, safetensors, GGUF and ONNX

03Skills, Agents and Identity3 lessons

Skills and Agent Configurations as First-Class Inventory Objects
Agent Identity as Inventory: Which Agent Holds What Access, at What Level
MCP Servers in the Inventory and the Gold Registries

04Governance and Reporting3 lessons

Policies, Guardrails and Gates on AI Assets: From Inventory to Enforcement
Exporting, Publishing and Sharing the AI-BOM: Portal, Trust Center and TPRM
Compliance Evidence: EU AI Act, ISO/IEC 42001 and NIST AI RMF Through Continuous Mapping

05Building the Program2 lessons

Building the AI-BOM Program: Ownership, Cadence, Data Quality and Metrics
Worked Example: A Bank Inventories Its AI Estate2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.