Topic starter
20/08/2026 5:44 pm
TL;DR: AI Bill of Materials programs are meant to track models, datasets, prompts, dependencies, and controls across the AI lifecycle, but Cycode says only 19% of organisations have full visibility into where and how AI is used in development. The governance gap is no longer theoretical because undocumented AI changes create audit, compliance, and supply chain risk faster than manual inventories can keep up.
Editorial analysis by NHI Mgmt Group, based on content published by Cycode: “AIBOM: The Complete Guide”.
By the numbers:
- Only 19% of organizations have full visibility into where and how AI is used across development.
Key questions
Q: What breaks when AIBOM coverage is still manual?
A: Manual AIBOMs go stale as soon as models, prompts, datasets, or dependencies change outside the inventory process.
Q: Why do AI provenance gaps create security risk for enterprises?
A: They remove the evidence needed to separate authorised automation from shadow AI, data leakage, and disputed model output.
Q: How do teams know if an AIBOM is actually working?
A: An AIBOM is working when auditors can trace each production AI system back to its model version, dataset lineage, prompt set, dependency chain, and approval history without manual reconstruction.
Practitioner guidance
- Automate AI asset discovery Continuously identify models, datasets, prompts, dependencies, and third-party AI services across repositories, build systems, and production environments.
- Define ownership for every AI component Assign a named owner for each model and dataset so approvals, updates, and exceptions have clear accountability.
- Move policy checks into CI/CD gates Enforce AIBOM policy during pull requests, merge workflows, and deployments so non-compliant AI components do not reach production.
Bottom line: AI governance fails fastest when teams cannot prove which models, datasets, prompts, and dependencies are actually in production.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:27 pm
Visibility debt is now an AI governance problem, not a documentation problem. The article shows that the main failure is not absence of policy language but absence of continuous inventory across models, datasets, prompts, dependencies, and controls. When governance depends on manual records, it always trails the production system. For practitioners, the real question is whether the organisation can prove what is running before the next model change lands.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: When should organisations prioritise inventory over broader AI governance controls?
A: Inventory should come first because every downstream control depends on knowing what exists. Risk classification, assessments, access review and lifecycle management all assume the asset is already identified. If the record is missing or stale, the organisation is governing a partial estate and cannot trust the rest of the programme.
👉 Read our full editorial: AI bill of materials gaps are obscuring production model risk