AI Software Bill of Materials: From the EU AI Act to Your MLOps

### Overview In this talk, Adrian Gonzalez—a data specialist at Microsoft and member of the Linux Foundation's responsible AI committee—discusses bridging the gap between legal AI regulations and technical implementation. As organizations face an evolving landscape of ethics, governance, and mandatory regulations such as the EU AI Act, translating policy papers into actionable engineering workflows becomes critical. Gonzalez introduces the concept of an "AI Software Bill of Materials" (AI SBOM)—an open-source JSON specification designed to capture transparency and accountability requirements for AI systems and integrate them directly into MLOps pipelines.

### Key Topics - **Convergence of Ethics and Regulation:** Transitioning from voluntary internal principles and morals to enforceable government mandates (e.g., EU AI Act, Canada's Artificial Intelligence and Data Act, GDPR). - **AI Governance Ecosystem:** Balancing human, technical, and business factors through cross-functional oversight, industry standards (such as ISO 42001 and CEN), and internal compliance processes. - **Machine-Readable Transparency:** Creating a structured JSON specification for AI SBOM hosted on Hugging Face to document model cards, data provenance, system architectures, and market scope. - **Automating Compliance:** Using AI agents (guided via system prompts and context windows) to gather compliance data interactively, and leveraging AI orchestration frameworks to automate logging and telemetry.

### Technical Details Gonzalez highlights that the EU AI Act emphasizes shared accountability between foundational platform providers (e.g., cloud providers) and downstream adopters. To translate these mandates into machine-readable formats, Gonzalez and collaborators (including the Linux Foundation, OpenEthics/OA, and the Applied Institute in Germany) created an open-source JSON specification hosted on Hugging Face.

The JSON structure outlines transparency requirements, capturing: - Provider information and appointed compliance contacts (similar to DPOs under GDPR). - Intended markets (EU, US, Canada, China) and classification of use cases (e.g., prohibited practices like social scoring vs. high-risk domains like justice or education). - Technical system descriptions, including generative AI disclosures, input/output behaviors, intended applications, and potential misuse. - Detailed training, evaluation, and test datasets, specifying whether data is proprietary, external, or subject to copyright, alongside data modalities (text, SQL, images).

Gonzalez demonstrates how this structure can feed directly into an LLM via system prompts to create an internal compliance assistant that queries engineers step-by-step and outputs valid JSON. Furthermore, he proposes integrating this specification with open-source AI orchestration engines—such as LangChain, Semantic Kernel, and Ollama. Because these engines already manage routing and incorporate execution telemetry and logging (e.g., LangSmith), they represent a key architectural point to capture runtime metadata and automate compliance documentation directly within MLOps.

### Takeaways While regulations like the EU AI Act phase in toward 2030, engineering teams must prepare early. While large corporations can absorb compliance overhead, smaller organizations and open-source practitioners can leverage open frameworks, model cards, and AI SBOM JSON specifications to address transparency mandates efficiently. When asked about broader standardization, Gonzalez noted that while comprehensive initiatives like the Linux Foundation's SPDX (version 3 AI profile) are developing overarching standards, ad-hoc JSON specifications serve as immediate, targeted blueprints for automating regulatory transparency.