An AI-BOM extends the inventory idea to the artifacts that make an AI system what it is, so a question like which of our products used this compromised base model becomes answerable. Hardware requirements, runtime prompts and deployment topology are operational metadata rather than components of the artifact.
Official docs