RAI Bill of Materials

Summary: An RAI bill of materials maintains a list of components used to create an AI software product, which AI solution procurers and consumers can use to check the supply chain details of each component of interest and make buying decisions.

Type of pattern: Governance patterns

Type of objective: Trust

Target users: Management teams

Impacted stakeholders: Employees, AI users, AI impacted subjects, AI consumers

Lifecycle stages: All stages

Relevant AI ethics principles: HSE well-being, human-centered values, fairness, privacy protection & security, reliability & safety, transparency & explainability, contestability, accountability

Mapping to AI regulations/standards: EU AI Act, ISO/IEC 42001:2023 Standard.

Context: The development of AI systems often involves complex and dynamic software supply chains, as many organizations procure AI technologies and solutions from third parties to build their AI systems. These systems may be assembled using a variety of commercial or open-source AI and non-AI components from different sources. While procuring AI technologies and solutions from third parties can be cost-efficient, it can also raise concerns about security and integrity. According to Sonatype’s report on 2021 state of the software supply chain, the software supply chain attacks increased 650% in 2021, while it was 430% in 2020.

Problem: How can we build trust in AI system supply chains?

Solution: An RAI bill of materials keeps a list of components used to create an AI software product. AI solution procurers and consumers can use this list to check the supply chain details of each component of interest and make buying decisions. According to NTIA’s The Minimum Elements for a Software Bill of Materials, the supply chain details should at least include component name, version, supplier, dependency relationship, author of software bill of materials data, and timestamp. This information provides traceability and transparency about the components and can allow procurers and consumers to easily check component information, such as supply chain details and context information, and to track ethical issues. By maintaining an RAI bill of materials, organizations can help build trust and confidence in their AI systems by providing detailed and transparent information about the components used in their systems.

Benefits:

  • Reduced vulnerability: RAI bill of materials can enable faster vulnerability identification by providing detailed and transparent in-formation about the third-party components used in an AI system.
  • Increased visibility: RAI bill of materials can make the supply chain of AI systems more visible and transparent.

Drawbacks:

  • Increased cost: RAI bill of materials may need to be updated frequently since AI systems evolve over time. Maintaining and updating the bill of materials can incur additional management costs, as it may require additional time and resources to keep the information accurate and current.
  • Lack of data integrity: The data integrity of RAI bill of mate-rials is dependent on the tool that is adopted for creating and maintaining the information.

Related pattern:

  • RAI bill of materials registry: The supply chain information of AI system components can be maintained in an AI software bill of material registry.
  • Verifiable RAI credential: Verifiable ethical credential can be applied to bill of materials to provide proof of responsibility at a specific point in the supply chain.

Known uses:

  • Dependency Track is widely used by practitioners to track components’ supply chain information and identify known vulnerabilities.
  • Software Package Data Exchange (SPDX) is a software bill of material standard for exchanging software supply chain related information, including component’s basic information, security information, IP information (such as licenses and copyrights).
  • CycloneDX is a standard for communicating software bill of material information for performing software supply chain security analysis.