{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3f6c2a1e-8b4d-4c3a-9e2f-5d7a1b0c9e44",
  "version": 1,
  "metadata": {
    "timestamp": "2026-10-23T00:00:00Z",
    "component": {
      "type": "application",
      "bom-ref": "app-support-assistant",
      "name": "support-assistant",
      "version": "1.0.0",
      "description": "Example internal application that calls a closed, hosted model. Replace with your own application."
    },
    "properties": [
      { "name": "aibom:recordedBy", "value": "Replace with the owning team" },
      { "name": "aibom:sourcesReadOn", "value": "2026-10-23" },
      { "name": "aibom:reviewTrigger", "value": "On model ID change, new system card or EU training content summary, or every six months" }
    ]
  },
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "model-claude-opus-5-5",
      "supplier": { "name": "Anthropic", "url": [ "https://www.anthropic.com" ] },
      "name": "claude-opus-5-5",
      "version": "claude-opus-5-5",
      "description": "Hosted model called via the Claude API. Identity fields transcribed from the provider's own pages; training data composition not published by the provider.",
      "externalReferences": [
        { "type": "model-card", "url": "https://www.anthropic.com/system-cards", "comment": "Provider system cards (PDF), including evaluations and limitations" },
        { "type": "documentation", "url": "https://www.anthropic.com/transparency", "comment": "Transparency Hub model report, including a prose training data description" },
        { "type": "documentation", "url": "https://docs.anthropic.com/en/docs/about-claude/models/overview", "comment": "Model IDs, training data cutoff and retirement date" }
      ],
      "modelCard": {
        "bom-ref": "modelcard-claude-opus-5-5",
        "modelParameters": {
          "task": "text generation",
          "datasets": [ { "ref": "data-provider-training-mix" } ],
          "inputs": [ { "format": "text" }, { "format": "image" } ],
          "outputs": [ { "format": "text" } ]
        },
        "considerations": {
          "useCases": [ "Replace with your approved use case, for example internal summarisation of non personal data" ],
          "technicalLimitations": [
            "Training datasets, dataset licences, dataset versions, sizes, hashes and mixture proportions are not published by the provider",
            "Architecture details are not published by the provider"
          ]
        },
        "properties": [
          { "name": "aibom:modelArchitecture", "value": "unknown (not published by provider)" },
          { "name": "aibom:trainingApproach", "value": "Provider describes pretraining on large, diverse datasets followed by substantial post-training" }
        ]
      },
      "properties": [
        { "name": "aibom:trainingDataCutoff", "value": "2026-06 (provider docs)" },
        { "name": "aibom:retirement", "value": "Not sooner than 2027-09-22 (provider docs)" },
        { "name": "aibom:energyConsumption", "value": "unknown (not found on provider pages read)" },
        { "name": "aibom:euTrainingContentSummary", "value": "unknown (not located on provider or Commission pages on 2026-10-23)" },
        { "name": "aibom:customerDataUsedForTraining", "value": "Replace with the setting and contract terms for your account" },
        { "name": "aibom:riskAcceptance", "value": "Replace with owner, basis and expiry date" }
      ]
    },
    {
      "type": "data",
      "bom-ref": "data-provider-training-mix",
      "name": "Provider training data (as described by provider)",
      "description": "Composition not published. See compositions entry with aggregate unknown.",
      "data": [
        {
          "type": "dataset",
          "name": "Pretraining and post-training mix",
          "description": "Provider describes a proprietary mix of publicly available information from online sources, public and private datasets, user data, and synthetic data generated by other models, with data cleaning and filtering including deduplication and classification (Transparency Hub, read 2026-10-23)."
        }
      ],
      "properties": [
        { "name": "aibom:datasetList", "value": "unknown" },
        { "name": "aibom:datasetLicences", "value": "unknown" },
        { "name": "aibom:datasetVersionsAndHashes", "value": "unknown" },
        { "name": "aibom:datasetSize", "value": "unknown" },
        { "name": "aibom:mixtureProportions", "value": "unknown" }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pkg-anthropic-python-sdk",
      "name": "anthropic",
      "version": "replace-with-pinned-version",
      "purl": "pkg:pypi/anthropic",
      "description": "Provider SDK used by the application. Generate this part from your normal SBOM tooling."
    }
  ],
  "services": [
    {
      "bom-ref": "svc-claude-api",
      "provider": { "name": "Anthropic" },
      "name": "Claude API",
      "endpoints": [ "https://api.anthropic.com/v1/messages" ],
      "authenticated": true,
      "x-trust-boundary": true,
      "data": [
        { "flow": "outbound", "classification": "Replace with the data classes you send, for example internal-non-personal" },
        { "flow": "inbound", "classification": "model-output" }
      ]
    }
  ],
  "dependencies": [
    { "ref": "app-support-assistant", "dependsOn": [ "model-claude-opus-5-5", "pkg-anthropic-python-sdk", "svc-claude-api" ] },
    { "ref": "model-claude-opus-5-5", "dependsOn": [ "data-provider-training-mix" ] }
  ],
  "compositions": [
    { "aggregate": "unknown", "assemblies": [ "data-provider-training-mix" ] },
    { "aggregate": "incomplete_first_party_only", "assemblies": [ "app-support-assistant" ] }
  ]
}