AI supply-chain trust assessment for the AI industry using AIBOM and trust attestation

The Challenge

Organisations adopting AI have no systematic way to judge whether a complex, computationally heterogeneous AI system — models, training data, frameworks and services assembled from many suppliers — can be trusted. Existing software supply-chain tools (SBOMs) do not capture AI-specific artefacts such as datasets, weights and retraining cycles, leaving developers, auditors and buyers unable to assess provenance or continuously assure the systems they depend on.

The Solution

T-CHAIN (Trusted Computationally Heterogeneous AI Networks) was a short Phase 1 feasibility study examining trust and continuous assurance in complex, heterogeneous AI systems and networks. NQM applied its trusted-data experience — signed claims, attestation and continuous assurance concepts proven in its network-security work — to establish how AI supply chains could be documented, attested and continuously assured, working with TechWorks and the IoT Security Foundation to ground the study in industry needs.

Outcomes

The study established the technical foundations for AI bills of materials (AIBOM) and trust attestation, and assembled the consortium base for the next phase. Its findings directly seeded the Phase 2 project TAIBOM (Trustable AI Bill of Materials), which expanded the concept into a full AIBOM framework with cryptographic attestation and provenance tracking, and has since become a TechWorks working group.