Enterprise AI Supply Chain Security Governance: A Framework for Secure  Open-Source AI Model Adoption Using an Artificial Intelligence Bill of Materials (AI-BOM)

Sandeep Kumar Anuguthala; Harish Namani

doi:10.36948/ijfmr.2026.v08i03.78068

Enterprise AI Supply Chain Security Governance: A Framework for Secure Open-Source AI Model Adoption Using an Artificial Intelligence Bill of Materials (AI-BOM)

Author(s)	Sandeep Kumar Anuguthala, Harish Namani
Country	United States
Abstract	The rapid availability of open-source AI models accelerates enterprise innovation but introduces supply-chain risks — malicious serialized artifacts, vulnerable dependencies, and licensing violations — that existing SBOM frameworks and emerging AI-specific schema standards (CycloneDX ML-BOM, SPDX 3.0 AI profile) address only at the data-format level, not at the operational governance level. This paper introduces the Artificial Intelligence Bill of Materials (AI-BOM), an eight-category schema, integrated within the Enterprise AI Supply Chain Security Architecture (E-AISCSA): a ten-layer governance framework with a semi-quantitative Weighted Risk Score (WRS = 0.35×AR + 0.30×SR + 0.25×DR + 0.10×PR). Evaluation across ten Hugging Face NLP models confirmed framework feasibility: all models used pickle-serialized weights, all carried CVE-2024-3568 (CVSS 9.6 Critical) in their transformers dependency, one model was rejected as High Risk (WRS 5.60), and nine received conditional Medium-Risk approval. The framework aligns with NIST AI RMF 1.0, ISO/IEC 42001:2023, and EU AI Act requirements. Raw experimental data are available from the authors upon request.
Keywords	AI supply chain security; AI-BOM; model governance; MLOps; enterprise AI security; open-source AI models; serialization vulnerabilities; provenance risk; weighted risk scoring.
Field	Engineering
Published In	Volume 8, Issue 3, May-June 2026
Published On	2026-05-10
DOI	https://doi.org/10.36948/ijfmr.2026.v08i03.78068

View / Download PDF File

E-ISSN 2582-2160

doi

CrossRef DOI is assigned to each research paper published in our journal.

IJFMR DOI prefix is
10.36948/ijfmr

Downloads

Research Paper Format Copyright Permission Form and Undertaking Form Cover Page Vol 8 Isu 2 Cover Page Vol 8 Isu 1 Cover Page Vol 7 Isu 6

All research papers published on this website are licensed under Creative Commons Attribution-ShareAlike 4.0 International License, and all rights belong to their respective authors/researchers.

CC-BY-SA

About IJFMR Fees & Payment Current Issue Publication Archive	Submit Research Paper Track Submission Status Publication Guidelines Publication Ethics Peer Review & Plagiarism	Join as a Reviewer Editors & Reviewers Reviewer Referral Program Get Reviewer Membership Certi.	Website/Journal Policies Usage Policy Content Policies Privacy Policy

Contact Us		+91-9687-828-838	editor@ijfmr.com

International Journal For Multidisciplinary Research

A Widely Indexed Open Access Peer Reviewed Multidisciplinary Bi-monthly Scholarly International Journal

Enterprise AI Supply Chain Security Governance: A Framework for Secure Open-Source AI Model Adoption Using an Artificial Intelligence Bill of Materials (AI-BOM)

Share this