If we keep it out of the weeds, there is really only one concept to hold on to: the bill of materials, the BOM. BOM, Bill of Materials. As everyone knows, when we make a piece of software it is the same as with hardware: it is not handcrafted end to end by time-honored methods. Even the National Center for Traditional Arts has left that behind. The point is that you use a great many things other people have already made, open-source things above all, and you do not know whether the source has been contaminated, whether it has been poisoned, and so on. In that situation the only way you can trust it is to number every material; after numbering, compute its fingerprint, which is its hash. Even if the upstream tampers with the record, the hash is certain to be different, so you know: my upstream was poisoned, my material was contaminated. Hardware has the BOM; this is software’s BOM, the SBOM . And so, as we said, there has to be such a thing as an AI BOM.