EU AI Act and Hardware: Documenting AI Infrastructure with an HBOM
High-risk AI runs on real hardware: accelerators, servers and edge devices. An HBOM documents that infrastructure so your EU AI Act technical documentation reflects the whole system, not just the model.
- Annex IV technical documentation covers the system's components, including the computational resources it depends on.
- An HBOM inventories the hardware, accelerators and firmware behind an AI system.
- Edge and embedded AI makes the hardware layer part of the system's risk and security story.
- An HBOM complements the AI BOM and SBOM for a complete system description.
AI has a hardware layer
High-risk AI systems do not run in the abstract. They run on GPUs and other accelerators, servers, and, increasingly, edge and embedded devices. The EU AI Act, Regulation (EU) 2024/1689, requires technical documentation under Article 11 and Annex IV that describes the system and the computational resources it uses [1][2]. For embedded and edge AI, the hardware is part of the product and part of its security story.
What an HBOM documents
A hardware bill of materials (HBOM) inventories the physical components, accelerators, firmware and manufacturers that an AI system depends on. For a device that ships a model at the edge, that is as much part of the technical documentation as the model itself, and it is where firmware vulnerabilities and supply-chain provenance live.
| HBOM element | AI Act relevance |
|---|---|
| Accelerator and device inventory | Computational-resource description in Annex IV |
| Firmware versions | Security of the system under Article 15 |
| Manufacturer and supplier trace | Supply-chain provenance for the AI infrastructure |
Edge and embedded AI
When an AI system ships as a device, or on one, the CRA governs it as a product with digital elements while the AI Act governs it as an AI system. An HBOM, with firmware analysed into SBOMs, serves both. See EU CRA and hardware.
A complete system picture
The AI BOM documents models and data, the SBOM documents software, and the HBOM documents hardware and firmware. Together they give an AI Act provider the end-to-end component record Annex IV expects.
How IntelliXBOM helps
IntelliXBOM generates HBOMs during scanning, analyses firmware into SBOMs, maps components to manufacturers, and keeps the HBOM next to the AI BOM, SBOM and CBOM for the same system. See firmware BOMs. It supplies evidence; AI Act conformity remains the provider's responsibility.
Frequently asked questions
Does the EU AI Act require hardware documentation?
Annex IV requires a description of the system, including the computational resources it uses. For embedded or edge AI, the hardware is part of the system, and an HBOM is the structured way to document it.
When is hardware most relevant to the AI Act?
For edge and embedded AI that ships as or on a device. There the hardware and firmware are part of the product's risk and security, and often also fall under the Cyber Resilience Act.
How does an HBOM fit with the AI BOM?
The AI BOM covers models and datasets; the HBOM covers the hardware and firmware they run on. Both support the technical documentation an AI Act provider must maintain.
Sources
- Regulation (EU) 2024/1689 (Artificial Intelligence Act)EUR-Lexeur-lex.europa.eu/eli/reg/2024/1689/oj
- AI Act Article 11 and Annex IV: Technical documentationEU AI Act explorerartificialintelligenceact.eu/article/11/
- CycloneDX Bill of Materials standardOWASP CycloneDXcyclonedx.org/
Sources checked in September 2026. Regulations and guidance change; always refer to the issuing body’s current publication. This content is for general information and is not legal advice.