The AI SBOM Securing the Supply Chain Beyond the Gateway

Artificial intelligence systems are transforming enterprise infrastructure while expanding the software supply chain attack surface. Traditional Software Bills of Materials (SBOMs) track code dependencies, yet AI introduces opaque components that evade conventional visibility: pre-trained model weights, training datasets, fine-tuning pipelines, and GPU-accelerated infrastructure. The AI-SBOM extends existing SBOM practice to capture the provenance, lineage, and security posture of these components. This article consolidates emerging guidance (the G7 minimum elements for AI SBOMs, CISA's 2025 SBOM minimum elements, and the AI extensions of the SPDX and CycloneDX standards) into an actionable taxonomy for the practicing IT professional, introduces a four-level verifiability grading that turns AI-SBOM trustworthiness into a measurable property, pairs both with a phased implementation roadmap grounded in recent supply chain compromises, and assesses the approach's current limitations. Preprint of a manuscript submitted to IEEE IT Professional.