AIBOM compliance: EU AI Act, CERT-In, NIST AI RMF, ISO/IEC 42001 and Indian guidance

Few rules use the word AIBOM, but many require the information an AIBOM holds. This overview maps the main frameworks to the inventory they expect and gives the dates that matter.

One inventory, many frameworks

Regulators and standards bodies ask similar questions about AI systems: what models are in use, where they came from, what data trained them, how they perform, and who is accountable. An AIBOM answers these questions once, in a structured form, so the same record can support several frameworks. The table summarises the main ones as of September 2026.

CERT-In

CERT-In's Technical Guidelines on SBOM, QBOM & CBOM, AIBOM and HBOM, Version 2.0, define the AIBOM and list its minimum elements, including model name, version, type, developer, licensing, software dependencies, ML models and algorithms, performance metrics, data source and data-set information ^[1]. Commentary notes that government, public-sector and essential-services organisations are expected to include AIBOMs in AI procurement ^[2]. See CERT-In AIBOM requirements.

EU AI Act and the AI Omnibus

Providers of high-risk AI systems must prepare technical documentation before placing a system on the market and keep it up to date ^[3]. Annex IV requires, among other things, software versions, use of third-party pre-trained systems, and datasheets describing training data and its provenance ^[4]. Providers of general-purpose AI models must maintain technical documentation, give downstream providers information, and publish a summary of training content ^[5].

The AI Omnibus entered into force on 27 July 2026. It moved the application of high-risk rules to 2 December 2027 for Annex III systems and 2 August 2028 for high-risk AI in products covered by Annex I ^[6]. Obligations for general-purpose AI models have applied since 2 August 2025 ^[7]. See EU AI Act and AIBOM.

NIST AI RMF

NIST released AI RMF 1.0 on 26 January 2023, organised into four functions: Govern, Map, Measure and Manage. The Generative AI Profile, NIST AI 600-1, followed on 26 July 2024, and NIST states that AI RMF 1.0 is being revised ^[8]. The framework is voluntary. An AIBOM supplies the system inventory and dependency context that the Map function works from, and the change history that Manage relies on.

ISO/IEC 42001

ISO/IEC 42001:2023, published in December 2023, specifies requirements for an AI management system ^[9]. Its Annex A control objectives include "Resources for AI systems", "Data for AI systems" and "Third-party and customer relationships", which call for documenting the data, tooling and computing resources each system depends on and where training data came from ^[10]. An AIBOM is a natural record for these controls.

India: MeitY and RBI

MeitY released the India AI Governance Guidelines on 5 November 2025. They are not new legislation; they set out seven principles and recommendations to be applied through existing law where possible ^[11]. Summaries describe proposals for transparency reports, a national AI incidents database and graded accountability across the AI value chain ^[12].

The RBI's Framework for Responsible and Ethical Enablement of AI (FREE-AI) committee report, released on 13 August 2025, recommends that regulated entities adopt board-approved AI policies and that AI inventories be created covering models, use cases, dependencies and risks ^[13]. It contains 26 recommendations across six pillars ^[14]. See AIBOM for banks and AIBOM for Indian enterprises.

A practical sequence

1. Build one AIBOM per AI system, using fields that satisfy the strictest framework you report against.
2. Map each field to the control or article it supports.
3. Keep version history, because most frameworks expect records to stay current.
4. Produce evidence packages from the same inventory rather than rewriting documents per framework.

How IntelliXBOM helps

IntelliXBOM validates AIBOMs against required-field policies such as the CERT-In elements, maps the inventory to framework controls including the EU AI Act, NIST AI RMF and ISO/IEC 42001, and produces timestamped evidence. Version history and diffs show how the record changed over time.

This article summarises public guidance and is not legal advice.