{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5f4b1d3e-2c7a-4b8e-9a61-0d2f7c3e8b10",
  "version": 1,
  "metadata": {
    "timestamp": "2026-10-23T09:00:00Z",
    "lifecycles": [ { "phase": "operations" } ],
    "authors": [ { "name": "AI governance team", "email": "ai-governance@example.com" } ],
    "component": {
      "type": "application",
      "bom-ref": "app:support-assistant",
      "name": "support-assistant",
      "version": "3.4.0",
      "description": "Customer support assistant. Example AIBOM of an application's USE of hosted closed models. Fields under aibom:layer=provider-asserted come from the provider's published documents and are not independently verified.",
      "properties": [
        { "name": "aibom:owner", "value": "support-platform-team" },
        { "name": "aibom:next-review", "value": "2027-01-23" },
        { "name": "aibom:risk-tier", "value": "customer-facing, no automated decisions about people" }
      ]
    },
    "properties": [
      { "name": "aibom:note", "value": "Example file. Replace endpoints, settings and dates with your own confirmed values." }
    ]
  },
  "components": [
    {
      "type": "library",
      "bom-ref": "pkg:pypi/anthropic@0.0.0-example",
      "name": "anthropic",
      "version": "0.0.0-example",
      "purl": "pkg:pypi/anthropic@0.0.0-example",
      "description": "Official provider SDK used to call the primary model. Replace the version with the one in your lockfile."
    },
    {
      "type": "library",
      "bom-ref": "pkg:pypi/openai@0.0.0-example",
      "name": "openai",
      "version": "0.0.0-example",
      "purl": "pkg:pypi/openai@0.0.0-example",
      "description": "Official provider SDK used to call the fallback model. Replace the version with the one in your lockfile."
    },
    {
      "type": "machine-learning-model",
      "bom-ref": "model:anthropic/claude-opus-5-5",
      "supplier": { "name": "Anthropic", "url": [ "https://www.anthropic.com" ] },
      "name": "claude-opus-5-5",
      "version": "claude-opus-5-5",
      "description": "Hosted closed model, primary. Weights and training datasets are not available to the deployer. Per the provider's versioning documentation, IDs from the 4.6 generation onward map to a fixed snapshot.",
      "modelCard": {
        "modelParameters": {
          "task": "text-generation",
          "architectureFamily": "not disclosed by supplier",
          "datasets": [
            {
              "type": "dataset",
              "name": "provider-training-data",
              "description": "Not disclosed at dataset level (sources, licences, versions). Provider description (Transparency Hub, Model Report, retrieved 2026-10-23): proprietary mix of publicly available information from online sources, public and private datasets, user data, and synthetic data generated by other models; cleaning included deduplication and classification. Dataset-level list requested from supplier 2026-10-23, answer pending.",
              "classification": "unknown"
            }
          ],
          "inputs": [ { "format": "text" } ],
          "outputs": [ { "format": "text" } ]
        },
        "quantitativeAnalysis": {
          "performanceMetrics": [
            { "type": "task-pass-rate", "value": "0.94", "slice": "internal support test set v7 (412 cases)" },
            { "type": "prompt-injection-resistance", "value": "0.97", "slice": "internal injection-via-retrieval set v3 (120 cases)" }
          ]
        },
        "considerations": {
          "users": [ "Support agents (human review before sending replies to customers)" ],
          "useCases": [ "Draft replies to customer support tickets using retrieved help-centre articles" ],
          "technicalLimitations": [ "See provider system card for documented limitations", "Observed: may cite help-centre articles that retrieval did not return; mitigated by citation check" ]
        }
      },
      "properties": [
        { "name": "aibom:layer", "value": "mixed: identity and evaluation verified by deployer; training data provider-asserted" },
        { "name": "aibom:platform", "value": "Claude API (Anthropic operated)" },
        { "name": "aibom:lifecycle-state", "value": "active" },
        { "name": "aibom:retirement-date", "value": "not announced; check provider deprecations page" },
        { "name": "aibom:lifecycle-checked", "value": "2026-10-23" },
        { "name": "aibom:pinned", "value": "true" },
        { "name": "aibom:knowledge-cutoff", "value": "see provider Transparency Hub; record value here" }
      ],
      "externalReferences": [
        { "type": "documentation", "url": "https://www.anthropic.com/system-cards", "comment": "System card index, retrieved 2026-10-23" },
        { "type": "documentation", "url": "https://www.anthropic.com/transparency", "comment": "Transparency Hub Model Report, retrieved 2026-10-23" },
        { "type": "documentation", "url": "https://platform.claude.com/docs/en/about-claude/models/model-ids-and-versions", "comment": "Model ID and snapshot semantics" },
        { "type": "documentation", "url": "https://platform.claude.com/docs/en/about-claude/model-deprecations", "comment": "Lifecycle states and retirement notice" }
      ]
    },
    {
      "type": "machine-learning-model",
      "bom-ref": "model:openai/gpt-6.1-sol",
      "supplier": { "name": "OpenAI", "url": [ "https://openai.com" ] },
      "name": "gpt-6.1-sol",
      "version": "gpt-6.1-sol",
      "description": "Hosted closed model, fallback when the primary is unavailable. Weights and training datasets are not available to the deployer.",
      "modelCard": {
        "modelParameters": {
          "task": "text-generation",
          "datasets": [
            {
              "type": "dataset",
              "name": "provider-training-data",
              "description": "Not disclosed at dataset level (sources, licences, versions). See provider system card and model page for the published description, retrieved 2026-10-23. Dataset-level list requested from supplier 2026-10-23, answer pending.",
              "classification": "unknown"
            }
          ],
          "inputs": [ { "format": "text" } ],
          "outputs": [ { "format": "text" } ]
        },
        "quantitativeAnalysis": {
          "performanceMetrics": [
            { "type": "task-pass-rate", "value": "0.92", "slice": "internal support test set v7 (412 cases)" }
          ]
        }
      },
      "properties": [
        { "name": "aibom:layer", "value": "mixed: identity and evaluation verified by deployer; training data provider-asserted" },
        { "name": "aibom:platform", "value": "OpenAI API" },
        { "name": "aibom:knowledge-cutoff", "value": "2026-04-30 (provider model page, retrieved 2026-10-23)" },
        { "name": "aibom:lifecycle-state", "value": "active" },
        { "name": "aibom:retirement-date", "value": "none announced (shutdown_date absent on GET /v1/models, checked 2026-10-23)" },
        { "name": "aibom:pinned", "value": "true" }
      ],
      "externalReferences": [
        { "type": "documentation", "url": "https://developers.openai.com/api/docs/models/gpt-6.1-sol", "comment": "Model page with snapshots and knowledge cutoff, retrieved 2026-10-23" },
        { "type": "documentation", "url": "https://deploymentsafety.openai.com/", "comment": "Deployment Safety Hub (system cards), retrieved 2026-10-23" },
        { "type": "documentation", "url": "https://developers.openai.com/api/docs/deprecations", "comment": "Notice periods and shutdown_date field" }
      ]
    }
  ],
  "services": [
    {
      "bom-ref": "svc:anthropic/messages-api",
      "provider": { "name": "Anthropic", "url": [ "https://www.anthropic.com" ] },
      "name": "anthropic-messages-api",
      "endpoints": [ "https://api.anthropic.com/v1/messages" ],
      "authenticated": true,
      "x-trust-boundary": true,
      "data": [
        { "flow": "outbound", "classification": "confidential: customer ticket text and retrieved internal help articles" },
        { "flow": "inbound", "classification": "internal: generated draft reply" }
      ],
      "properties": [
        { "name": "aibom:model-ref", "value": "model:anthropic/claude-opus-5-5" },
        { "name": "aibom:retention", "value": "provider default for API (deleted within 30 days, with published exceptions); no zero data retention agreement" },
        { "name": "aibom:training-use", "value": "per provider commercial terms; confirm in contract" },
        { "name": "aibom:feedback-surfaces", "value": "none exposed to agents" },
        { "name": "aibom:retention-confirmed", "value": "2026-10-23" }
      ],
      "externalReferences": [
        { "type": "documentation", "url": "https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data", "comment": "Retention terms, retrieved 2026-10-23" }
      ]
    },
    {
      "bom-ref": "svc:openai/responses-api",
      "provider": { "name": "OpenAI", "url": [ "https://openai.com" ] },
      "name": "openai-responses-api",
      "endpoints": [ "https://api.openai.com/v1/responses" ],
      "authenticated": true,
      "x-trust-boundary": true,
      "data": [
        { "flow": "outbound", "classification": "confidential: customer ticket text and retrieved internal help articles" },
        { "flow": "inbound", "classification": "internal: generated draft reply" }
      ],
      "properties": [
        { "name": "aibom:model-ref", "value": "model:openai/gpt-6.1-sol" },
        { "name": "aibom:retention", "value": "abuse monitoring logs up to 30 days (provider default); store=false set in code; no ZDR approval" },
        { "name": "aibom:training-use", "value": "API data not used for training unless opted in (provider data controls page); organisation opt-in setting: off" },
        { "name": "aibom:project-setting", "value": "project inherits organisation default" },
        { "name": "aibom:retention-confirmed", "value": "2026-10-23" }
      ],
      "externalReferences": [
        { "type": "documentation", "url": "https://developers.openai.com/api/docs/guides/your-data", "comment": "Data controls, retrieved 2026-10-23" }
      ]
    }
  ],
  "dependencies": [
    { "ref": "app:support-assistant", "dependsOn": [ "pkg:pypi/anthropic@0.0.0-example", "pkg:pypi/openai@0.0.0-example", "svc:anthropic/messages-api", "svc:openai/responses-api" ] },
    { "ref": "pkg:pypi/anthropic@0.0.0-example", "dependsOn": [ "svc:anthropic/messages-api" ] },
    { "ref": "pkg:pypi/openai@0.0.0-example", "dependsOn": [ "svc:openai/responses-api" ] },
    { "ref": "svc:anthropic/messages-api", "dependsOn": [ "model:anthropic/claude-opus-5-5" ] },
    { "ref": "svc:openai/responses-api", "dependsOn": [ "model:openai/gpt-6.1-sol" ] },
    { "ref": "model:anthropic/claude-opus-5-5" },
    { "ref": "model:openai/gpt-6.1-sol" }
  ]
}