{"id":"https://openalex.org/W4415318022","doi":"https://doi.org/10.1145/3786583.3786921","title":"Building an Open AIBOM Standard in the Wild: An Experience Report on Extending the SPDX SBOM (ISO/IEC 5962:2021) for AI Supply Chains","display_name":"Building an Open AIBOM Standard in the Wild: An Experience Report on Extending the SPDX SBOM (ISO/IEC 5962:2021) for AI Supply Chains","publication_year":2026,"publication_date":"2026-04-12","ids":{"openalex":"https://openalex.org/W4415318022","doi":"https://doi.org/10.1145/3786583.3786921"},"language":"en","primary_location":{"id":"doi:10.1145/3786583.3786921","doi":"https://doi.org/10.1145/3786583.3786921","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786583.3786921","pdf_url":null,"source":{"id":"https://openalex.org/S7407089274","display_name":"IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the IEEE/ACM 48th International Conference on Software Engineering: Software Engineering in Practice","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1145/3786583.3786921","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5052055475","display_name":"Gopi Krishnan Rajbahadur","orcid":"https://orcid.org/0000-0003-1812-5365","observed_orcids":["https://orcid.org/0000-0003-1812-5365"]},"institutions":[{"id":"https://openalex.org/I204722609","display_name":"Queen's University","ror":"https://ror.org/02y72wh86","country_code":"CA","type":"education","lineage":["https://openalex.org/I204722609"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Gopi Krishnan Rajbahadur","raw_affiliation_strings":["Queen's University, Kingston, Canada"],"raw_orcid":"https://orcid.org/0000-0003-1812-5365","affiliations":[{"raw_affiliation_string":"Queen's University, Kingston, Canada","institution_ids":["https://openalex.org/I204722609"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084188497","display_name":"Keheliya Gallaba","orcid":"https://orcid.org/0000-0002-5880-5114","observed_orcids":["https://orcid.org/0000-0002-5880-5114"]},"institutions":[{"id":"https://openalex.org/I204722609","display_name":"Queen's University","ror":"https://ror.org/02y72wh86","country_code":"CA","type":"education","lineage":["https://openalex.org/I204722609"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Keheliya Gallaba","raw_affiliation_strings":["Queen's University, Kingston, Canada"],"raw_orcid":"https://orcid.org/0000-0002-5880-5114","affiliations":[{"raw_affiliation_string":"Queen's University, Kingston, Canada","institution_ids":["https://openalex.org/I204722609"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068736509","display_name":"Elyas Rashno","orcid":"https://orcid.org/0000-0003-0813-3417","observed_orcids":["https://orcid.org/0000-0003-0813-3417"]},"institutions":[{"id":"https://openalex.org/I204722609","display_name":"Queen's University","ror":"https://ror.org/02y72wh86","country_code":"CA","type":"education","lineage":["https://openalex.org/I204722609"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Elyas Rashno","raw_affiliation_strings":["Queen's University, Kingston, Canada"],"raw_orcid":"https://orcid.org/0000-0003-0813-3417","affiliations":[{"raw_affiliation_string":"Queen's University, Kingston, Canada","institution_ids":["https://openalex.org/I204722609"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5016355180","display_name":"Arthit Suriyawongkul","orcid":"https://orcid.org/0000-0002-9698-1899","observed_orcids":["https://orcid.org/0000-0002-9698-1899"]},"institutions":[{"id":"https://openalex.org/I205274468","display_name":"Trinity College Dublin","ror":"https://ror.org/02tyrky19","country_code":"IE","type":"education","lineage":["https://openalex.org/I205274468"]}],"countries":["IE"],"is_corresponding":false,"raw_author_name":"Arthit Suriyawongkul","raw_affiliation_strings":["ADAPT Centre, Trinity College Dublin, Dublin, Ireland"],"raw_orcid":"https://orcid.org/0000-0002-9698-1899","affiliations":[{"raw_affiliation_string":"ADAPT Centre, Trinity College Dublin, Dublin, Ireland","institution_ids":["https://openalex.org/I205274468"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5013468986","display_name":"Karen Bennet","orcid":"https://orcid.org/0009-0002-0353-3518","observed_orcids":["https://orcid.org/0009-0002-0353-3518"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Karen Bennet","raw_affiliation_strings":["IEEE, Toronto, Canada"],"raw_orcid":"https://orcid.org/0009-0002-0353-3518","affiliations":[{"raw_affiliation_string":"IEEE, Toronto, Canada","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5029288846","display_name":"Kate Stewart","orcid":"https://orcid.org/0000-0001-8676-6565","observed_orcids":["https://orcid.org/0000-0001-8676-6565","https://orcid.org/0000-0003-1560-8329"]},"institutions":[{"id":"https://openalex.org/I4403928327","display_name":"Linux Foundation","ror":"https://ror.org/02krvw113","country_code":"US","type":"funder","lineage":["https://openalex.org/I4403928327"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kate Stewart","raw_affiliation_strings":["Linux Foundation, Austin, USA"],"raw_orcid":"https://orcid.org/0000-0003-1560-8329","affiliations":[{"raw_affiliation_string":"Linux Foundation, Austin, USA","institution_ids":["https://openalex.org/I4403928327"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5091586373","display_name":"Ahmed E. Hassan","orcid":"https://orcid.org/0000-0001-7749-5513","observed_orcids":["https://orcid.org/0000-0001-7749-5513"]},"institutions":[{"id":"https://openalex.org/I204722609","display_name":"Queen's University","ror":"https://ror.org/02y72wh86","country_code":"CA","type":"education","lineage":["https://openalex.org/I204722609"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Ahmed E. Hassan","raw_affiliation_strings":["Queen's University, Kingston, Canada"],"raw_orcid":"https://orcid.org/0000-0001-7749-5513","affiliations":[{"raw_affiliation_string":"Queen's University, Kingston, Canada","institution_ids":["https://openalex.org/I204722609"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.00384414,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"842","last_page":"853"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10430","display_name":"Software Engineering Techniques and Practices","score":0.551800012588501,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10430","display_name":"Software Engineering Techniques and Practices","score":0.551800012588501,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.14720000326633453,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13295","display_name":"Safety Systems Engineering in Autonomy","score":0.08070000261068344,"subfield":{"id":"https://openalex.org/subfields/2213","display_name":"Safety, Risk, Reliability and Quality"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/spdx","display_name":"SPDX","score":0.6510000228881836},{"id":"https://openalex.org/keywords/software-bill-of-materials","display_name":"software bill of materials","score":0.9459999799728394},{"id":"https://openalex.org/keywords/ai-supply-chain","display_name":"AI supply chain","score":0.902999997138977},{"id":"https://openalex.org/keywords/standardization","display_name":"standardization","score":0.5989999771118164},{"id":"https://openalex.org/keywords/eu-ai-act","display_name":"EU AI Act","score":0.7279999852180481},{"id":"https://openalex.org/keywords/open-standards","display_name":"open standards","score":0.4740000069141388}],"concepts":[{"id":"https://openalex.org/C188087704","wikidata":"https://www.wikidata.org/wiki/Q369577","display_name":"Standardization","level":2,"score":0.7520999908447266},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.678600013256073},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5145000219345093},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5113000273704529},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.44350001215934753},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.42989999055862427},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.42730000615119934},{"id":"https://openalex.org/C110354214","wikidata":"https://www.wikidata.org/wiki/Q6314146","display_name":"Engineering management","level":1,"score":0.4049000144004822},{"id":"https://openalex.org/C2780791683","wikidata":"https://www.wikidata.org/wiki/Q846785","display_name":"Action (physics)","level":2,"score":0.3808000087738037},{"id":"https://openalex.org/C143587482","wikidata":"https://www.wikidata.org/wiki/Q1543216","display_name":"Iterative and incremental development","level":2,"score":0.3587999939918518},{"id":"https://openalex.org/C180152950","wikidata":"https://www.wikidata.org/wiki/Q2904257","display_name":"Software development process","level":4,"score":0.35499998927116394},{"id":"https://openalex.org/C201995342","wikidata":"https://www.wikidata.org/wiki/Q682496","display_name":"Systems engineering","level":1,"score":0.33899998664855957},{"id":"https://openalex.org/C15845906","wikidata":"https://www.wikidata.org/wiki/Q1172338","display_name":"Data exchange","level":2,"score":0.33889999985694885},{"id":"https://openalex.org/C182500959","wikidata":"https://www.wikidata.org/wiki/Q7551380","display_name":"Social software engineering","level":5,"score":0.31360000371932983},{"id":"https://openalex.org/C39890963","wikidata":"https://www.wikidata.org/wiki/Q1702721","display_name":"Personal software process","level":5,"score":0.30559998750686646},{"id":"https://openalex.org/C10272871","wikidata":"https://www.wikidata.org/wiki/Q929972","display_name":"Software inspection","level":5,"score":0.28769999742507935},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.28349998593330383},{"id":"https://openalex.org/C135397884","wikidata":"https://www.wikidata.org/wiki/Q317623","display_name":"Technical standard","level":2,"score":0.27950000762939453},{"id":"https://openalex.org/C54534927","wikidata":"https://www.wikidata.org/wiki/Q4462275","display_name":"Software requirements","level":5,"score":0.2782999873161316},{"id":"https://openalex.org/C6604083","wikidata":"https://www.wikidata.org/wiki/Q376937","display_name":"Requirements engineering","level":3,"score":0.27559998631477356},{"id":"https://openalex.org/C102780508","wikidata":"https://www.wikidata.org/wiki/Q1761598","display_name":"Software requirements specification","level":5,"score":0.2727999985218048},{"id":"https://openalex.org/C186846655","wikidata":"https://www.wikidata.org/wiki/Q3398377","display_name":"Software construction","level":4,"score":0.27140000462532043},{"id":"https://openalex.org/C149091818","wikidata":"https://www.wikidata.org/wiki/Q2429814","display_name":"Software system","level":3,"score":0.26249998807907104}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1145/3786583.3786921","doi":"https://doi.org/10.1145/3786583.3786921","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786583.3786921","pdf_url":null,"source":{"id":"https://openalex.org/S7407089274","display_name":"IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the IEEE/ACM 48th International Conference on Software Engineering: Software Engineering in Practice","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2510.07070","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2510.07070","pdf_url":"https://arxiv.org/pdf/2510.07070","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2510.07070","doi":"https://doi.org/10.48550/arxiv.2510.07070","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2510.07070","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.1145/3786583.3786921","doi":"https://doi.org/10.1145/3786583.3786921","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786583.3786921","pdf_url":null,"source":{"id":"https://openalex.org/S7407089274","display_name":"IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the IEEE/ACM 48th International Conference on Software Engineering: Software Engineering in Practice","raw_type":"proceedings-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":39,"referenced_works":["https://openalex.org/W638828588","https://openalex.org/W1765266268","https://openalex.org/W2003205790","https://openalex.org/W2023877257","https://openalex.org/W2059149317","https://openalex.org/W2099592541","https://openalex.org/W2114269784","https://openalex.org/W2145829603","https://openalex.org/W2161496905","https://openalex.org/W2336854640","https://openalex.org/W2339106955","https://openalex.org/W2597403697","https://openalex.org/W2742375260","https://openalex.org/W2794181200","https://openalex.org/W2795038878","https://openalex.org/W2897042519","https://openalex.org/W2911599914","https://openalex.org/W3143449568","https://openalex.org/W3159979075","https://openalex.org/W3162290828","https://openalex.org/W4226199624","https://openalex.org/W4229584947","https://openalex.org/W4291213652","https://openalex.org/W4317952684","https://openalex.org/W4384345766","https://openalex.org/W4386977908","https://openalex.org/W4391853530","https://openalex.org/W4400266869","https://openalex.org/W4400484650","https://openalex.org/W4401172301","https://openalex.org/W4401878108","https://openalex.org/W4402057292","https://openalex.org/W4402594232","https://openalex.org/W4405535287","https://openalex.org/W4405713619","https://openalex.org/W4406125828","https://openalex.org/W4406184835","https://openalex.org/W4411550476","https://openalex.org/W7084147660"],"related_works":["https://openalex.org/W4405535287","https://openalex.org/W7171809530","https://openalex.org/W4414821061","https://openalex.org/W7117480204","https://openalex.org/W7117139406","https://openalex.org/W7117565616","https://openalex.org/W7223067853","https://openalex.org/W7160522154","https://openalex.org/W7171476938","https://openalex.org/W7134276629"],"abstract_inverted_index":{"Modern":[0],"software":[1,52,169],"engineering":[2,170],"increasingly":[3],"relies":[4],"on":[5,30,150],"open,":[6],"community-driven":[7],"standards,":[8],"yet":[9],"how":[10,151],"such":[11,62],"standards":[12,106],"are":[13],"created":[14],"in":[15,167],"fast-evolving":[16],"domains":[17],"like":[18],"AI-powered":[19],"systems":[20],"remains":[21],"underexplored.":[22],"This":[23],"paper":[24,136],"presents":[25],"a":[26,79,132],"detailed":[27],"experience":[28],"report":[29],"the":[31,34,44,71,138,142,146,155,168],"development":[32],"of":[33,37,43,54,73,140],"AI":[35,60,109],"Bill":[36],"Materials":[38],"(AIBOM)":[39],"specification,":[40],"an":[41,126],"extension":[42],"ISO/IEC":[45],"5962:2021":[46],"Software":[47],"Package":[48],"Data":[49],"Exchange":[50],"(SPDX)":[51],"bill":[53],"materials":[55],"(SBOM)":[56],"standard,":[57],"which":[58],"captures":[59],"components":[61],"as":[63],"datasets":[64],"and":[65,87,104,111,125,148,158],"iterative":[66],"training":[67],"artefacts.":[68],"Framed":[69],"through":[70,96],"lens":[72],"Action":[74],"Research":[75],"(AR),":[76],"we":[77],"document":[78],"global,":[80],"multi-stakeholder":[81],"effort":[82],"involving":[83],"over":[84],"90":[85],"contributors":[86],"structured":[88],"AR":[89,156],"cycles.":[90],"The":[91],"resulting":[92],"specification":[93,144],"was":[94],"validated":[95,133],"four":[97],"complementary":[98],"approaches:":[99],"alignment":[100],"with":[101,154],"major":[102],"regulations":[103],"ethical":[105],"(e.g.,":[107],"EU":[108],"Act":[110],"IEEE":[112],"7000":[113],"standards),":[114],"systematic":[115],"mapping":[116],"to":[117],"six":[118],"industry":[119],"use":[120],"cases,":[121],"semi-structured":[122],"practitioner":[123],"interviews,":[124],"industrial":[127],"case":[128],"study.":[129],"Beyond":[130],"delivering":[131],"artefact,":[134],"our":[135],"documents":[137],"process":[139],"building":[141],"AIBOM":[143],"\u201cin":[145],"wild,\u201d":[147],"reflects":[149],"it":[152],"aligns":[153],"cycle,":[157],"distills":[159],"lessons":[160],"that":[161],"can":[162],"inform":[163],"future":[164],"standardisation":[165],"efforts":[166],"community.":[171]},"counts_by_year":[],"updated_date":"2026-10-29T09:56:32.521200","created_date":"2025-10-18T00:00:00"}